User should be able to generate an API key

If a user's API key is compromised, there's nothing that can be done. Makes it worse than a password, which can be changed.