User should be able to generate an API key

If a user's API key is compromised, there's nothing that can be done. Makes it worse than a password, which can be changed. This pull request creates a controller action and a schema just to change the API key.

**Note**: This isn't the ideal way to do this since the controller action is GET and it makes a change to the object.