auth: drop authenticating_api_key from AuthUser

It doesn't belong as a user property - it is more of a session property ...
which is what we already use instead.