Remove api key from dom in backend and frontend since the api now authenticates via the session as well

Fixes #4553