Implement API Key Create/Update Endpoints

This probably doesn't represent 100% of the feature set we want (e.g. administrators cannot deactivate other users' keys), but I think it's enough to begin working on other areas.
If we return 403 (I think you meant this instead of 401) in the case where a user has valid credentials and is looking at a valid api key that belongs to someone else, then the user knows he has discovered someone else's valid api key.  They can then impersonate that user.