DEPRECATION: Remove support for api creds in query params (PR #9106)

This commit removes support for api credentials in query params except for a few whitelisted routes like rss/json feeds and the handle_mail route.

Several tests were written to valid these changes, but the bulk of the spec changes are just switching them over to use header based auth so that they will pass without changing what they were actually testing.

Original commit that notified admins this change was coming was created over 3 months ago: 2db20031879dbafd1a90cbb1a43bca55d51c1b08