api auth fix for basic and jwt

makes sure we encrypt the jwt token using the correct secret
(from apiKey.properties) and make sure to check the secret key
for basic auth as well.
It is *never* ok to send API Key `secret` values across the wire as query parameters.  Why does this line exist?