Challenge level security for API keys

[scarroll32]

At present the challenge API key is verified, but it is not tied to a specific challenge.

  def auth_by_api_key
    authenticate_or_request_with_http_token do |token, options|
      challenge = Challenge.where(api_key: token).first
      (token == ENV['CROWDAI_API_KEY'] || challenge.present?)
    end
  end

[scarroll32]

Closed by #327