Lock down thermal API's via dispatch_api hook.

Key is now required to access API's.
API calls to thermal run as user 1, allowing full access

All calls should be via API.kent (key is private)