Consistent API key authentication

[charvolant]

The various controllers in the collectory have different authentication requirements. Some allow an API key and some only allow authentication via the auth user-password-cookie framework. It would be useful to allow API key authentication across all possible services, so that scripts can easily update things.

I'd like to suggest that all controllers allow the following:

• Straight auth-based cookies, like what a real person uses
• For POST/PUT methods, an "api_key" field in the provided JSON data
• A cookie with ALA-API-Key=... for all methods (allows GETs to get in on the action without having to use a payload)