Fix API auth bug, and show apiKey at /profile

This does two things:

- shows apiKey in web interface after connecting via oauth
- fixes an issue that was preventing the apiKey from actually being used (since for whatever reason it still bounces through oauth server each time anyway, I guess to make sure user account is still active or something…)
The underlying .env setting has to be a full URL, e.g. "http://127.0.0.1:3002", for the OAuth redirect to work properly in other parts of the codebase. So the port is included in that.