don't do quota checks on API level or key level if they have -1 value (#2789)
don't do quota checks on API level or key level if they have -1 value (#2789)

fixes #2777 , #2780  

I think this line here is the culprit.

We create a new instance of access rights for each API in the policy and thus the GO runtime sets the default values to 0.  This essentially "turns on" limits for each API.
https://github.com/TykTechnologies/tyk/blob/master/gateway/middleware.go#L371

I believe this function (which runs after key creation), is supposed to cancel out the API level Limits, however it doesn't work correctly and never gets hit because the line above in `middleware.go` instantiates the Limit object.
https://github.com/TykTechnologies/tyk/blob/master/gateway/api.go#L198

This fix leaves the current logic as is, and adds an IF checks to see if Quotas are enabled before performing a quota check.


lonelycode/tyk,lonelycode/tyk,lonelycode/tyk