Add REST API key for security

To try to keep up with WP security improvements, is this something we should consider backporting?

A related, but different discussion: