Remove api key from dom in backend and frontend since the api controller...

... now authenticates via the session