Fix API key redacting for DEBUG=2

Just noticed it doesnt work properly, fixed and added a spec to catch these sort of issues next time