Create API key for each user and set permissions.

I'm seeing timeouts sometimes.

The next step is to get the client to use the API key instead of
the master username/password.