api/auth: move BasicAuthHandler-specific authentication errors to basic
api/auth/key: initial commit of KeyAuthHandler, use on all non-login API v0 routes