Define distinct third party API user checks

[br648]

All checks for requestingUser.apiUser != null will need to be re-evaluated and potentially replaced with RequestingUser.isThirdPartyUser.

Observed behavior

requestingUser.apiUser != null check can apply to first or third party API users. In some cases this probably should be just third party users.

Expected behavior

To correctly define the task in hand and apply the appropriate first/third/both API user checks.

Steps to reproduce the problem

No steps as such, but and example can be found in OtpUserController.preCreateHook

Any special notes on configuration used

N/A

Version of otp-middleware and/or OpenTripPlanner if applicable (exact commit hash or branch name)

#84