Enforce limits on API keys, Sessions

[danielballan]

The API keys and Sessions implementation, copied from Tiled, might benefit from this recent change to Tiled as well:

bluesky/tiled#252

[dmgav]

I will integrate it with the next set of changes to the HTTP server.