Add expiring API keys, initial /api/login output