basic api key management

page on hosting app to request and remove an api key.
use roles for api auth

and correctly handle the fact that legacy users do not have roles or
permissions