Limit API keys per Principal

[danielballan]

If a user creates a huge number of API keys the route to list their API keys could become to expensive. In the future we could paginate that route, but for now I propose to put a reasonable limit on the number of active API keys per user. Also, we should verify that the route does not include deleted/inactive keys.

When a user hits the limit, the remedy is to delete disused keys.