Update fulltext search to take care of private bookmarks

why do we need both test_user_apikey and test_user.api_key? Can we not just reference test_user.api_key?