Add authentication to "create run" endpoint

[mlandauer]

So that the whole service can safely be exposed to the internet

[mlandauer]

For a first pass of this we should allow a configuration (via an environment variable) for clay server that allows a single API key to be set. This will work fine for its first use case for morph.io but will not be enough for the range of use cases we expect clay to be used for.

[mlandauer]

Could we use Istio to do this? If we get something simple out of the box then that's a win.

[mlandauer]

I guess we don't strictly need this for the first public release as we're initially not going to have anything actually running in production for others to use. So, moving this to a lower priority