65534 times efficient, Brute-force attack for api_key

I have found that type checking for `api_key` is insufficient in rubygems.org's source code.

def authenticate_with_api_key
  api_key   = request.headers["Authorization"] || params[:api_key]
  @api_user = User.find_by_api_key(api_key)
end