API: Replace HTTP Basic auth with static key in custom header

Given that the key is sent in a custom header, this should prevent
any possible CSRF attacks.

Fixes #1769.
Merge pull request #1782 from zeha/api-key

API: Replace HTTP Basic auth with static key in custom header