Currently, GET _security/api_key requires you to provide some identifying information with which to find and retrieve keys. Can we support the retrieval of all API keys by default, in the absence of id, name, realm_name, and username?

CC @bizybot @tvernum @bytebilly @bmcconaghy