auth: make User.get_by_api_key more strict about only returning active non-default users

Thus drop some extra checks against default user.