The ApiHost used to require a security ticket for all API calls, so the
client side code used to be able to assume that  any request without one
was invalid and reject it. The backend now is able to handle requests
without security tickets in many cases, so the client side check is now
just getting in the way. This change removes that check and lets the
backend attempt to handle all requests.

The way the client implementation happened to require a security ticket
was actually by requiring a GAE context. This change removes that
constraint as well and removes the now-unecessary BackgroundContext.