Move DBD auth check for WCKey operations into the plugin

instead of only in the DBD.  We also make it possible for Operators to
manage WCKeys instead of just admins.