API: Replace HTTP Basic auth with static key in custom header

Given that the key is sent in a custom header, this should prevent
any possible CSRF attacks.

Fixes #1769.