Move api_key read permission checks from api to BAO