Api Key Authentication support

Continues the work from #41 and incorporates the changes from our review, specifically:

* Refactor the public interface `authenticateApiRequest` to take all options (scope factory, ttl, param search locations) as input to this method, rather than having to work with them after receiving an `AuthenticationResult`

* Do away with sub types of `AuthenticationResult` as they are not necessary
Options are also useful to override encryption defaults, etc.