Fix handling of client secret when searching for api keys

We don't send the secret over the wire but handle it locally.
Make sure client is authenticated only if the desired criteria is met
Add tests for getting api keys.