Add optionalApiKey option

I have use case where I use LocalAPIKey strategy to authenticate each REST request with apikey passed in query string with each request. And at the same time I am using password authentication with sessions to allow browser app have access to the same API endpoints. To allow that I had to allow Local API Key strategy not fail when 'apikey' is not found. This is optional and should not break existing applications.