Better error description for expired key

[msweier]

Is your feature request related to a problem? Please describe.
When an expired key is used, the message returned is "message":"No user for key

Describe the solution you'd like
A message saying key expired

Additional context
Tangentially related to #1553

[rma-psmorris]

@MikeNeilson please look into this one

[zack-rma]

An expired key should not have a unique error message per CWE-203 / CWE-204. See also: OWASP Authentication Cheat Sheet

An alternative error message could be set for all failed API key logins, along the lines of Authentication failed. The API Key may be invalid or no longer active.

[MikeNeilson]

Compared to our current message, the proposed one is far superior.