Implement API Key Create/Update Endpoints

This probably doesn't represent 100% of the feature set we want (e.g. administrators cannot deactivate other users' keys), but I think it's enough to begin working on other areas.
I don't understand the why there is a distinction between this and the 'invalid_credentials'.  Do we check the credentials are valid first, then check to see if they match the api-key's user?  If so I think we might be giving away information (I'll have to think about this more).  Seems like we should do the cheap check (user matches api-key's user) first, then validate the user, but if either check fails we should return 401.