Features/140 consistent apikey failures

This should close off #140 so that the API key is used in a consistent way between the submit, search and geolocate APIs.

I've reworked the testing base class so that database engine setup now explicitly deletes all content from both the master and slave tables.

The JSON response on search used to return  {'status': 'not_found'}, but now it returns the same NO_API_KEY JSON blob that geolocate was sending back.