remove _endpoint legacy entries
use the latest nitrogen module
fix granting logic for owner of ApiKey at principal creation