Disable the key that authenticated this request.

Without this, the only way to revoke a key is a person in the console - the wrong shape for a key that lives in CI or on a laptop that was just lost. A key can only revoke itself, so holding it grants nothing new. apikey_middleware reads the key fresh on every request, so the next call with it is a 401.