Users with an API key should be checked against their regular permissions also for the RESTful API. Also, enable API-only user roles