more secure API mode forces user to select an authentication method

Original version does not select a default value for  '_APIAuthentication'. The original version operates as if a shared secret key of empty string was chosen.  This set of changes defaults to a 'disable' choice for '_APIAuthentication' and warns if the shared secret is set to empty string.  An additional no-authentication method is also introduced as well, which while not very secure, at least the option is available.

FYI, I did not unit-test for "API key" mode.  I didn't have a test case handy.  This reminds me, unit testing would definitely be valuable. There are many combinations of features that can interfere with each other as demonstrated by yesterday's patch.