Allow API keys to toggle services. We only need to check whether
this is a user session since API keys don't support roles. This
means that once an API key is within the permissions check function
we already know that it has been explicitly granted access to this
endpoint via its allowlist.

(cherry picked from commit a54645566d755e79ce4a2e10bb5059b71c2fb986)
Co-authored-by: Andrew Walker <awalker@ixsystems.com>