Refactor API user loading out to own method.
Refactor API user loading out to own method.

This simplifies the logic around what the current user is.

There is now an assumption that the current logged in user is user to
use permissions for.  The secondary user is the user whose API key is
specified.

If both an API key are specified, and a user is logged in, the logged in
user takes precedence.

Fixes #4440

Hates/spree,Hates/spree,bjornlinder/Spree,bjornlinder/Spree,Hates/spree,Hates/spree,bjornlinder/Spree