Implement API Key Create/Update Endpoints

This probably doesn't represent 100% of the feature set we want (e.g. administrators cannot deactivate other users' keys), but I think it's enough to begin working on other areas.
I don't think the Key object has ever been looked up at the point when this would be called.  Even if it had, sqlalchemy sessions don't do caching, so I don't think it would effect anything.