Fix bugs around api key

With a staticmethod for _generate_api_key I was seeing weird
interactions across the test suite. Rather than track that down I'm just
punting and making it a normal method.