Fix #1971 by disabling AdminKey challenge unless explicitly requested.

Still automatically reads the auth header if present.

Will eventually take care of NuGet/NuGetGallery#1971 **when this version of the platform is used by the search service** (which will be before 3.0.4 releases :))