Be more appropriately HTTP with DELETE of auth key

DELETE should point to the resource being removed.

This happens, of course, to simplify both the client and server
code. Not sure what I was thinking before.