Extracts and validates API key from Authorization header or x-api-key. Assigns :api_key to the conn.
:api_key