Authentication on root handler potentially too lenient

The root handler currently is too lenient in accepting requests

https://github.com/elastic/apm-server/blob/2a88e25a60b4adc6f460b76d844c047dafb7e20f/beater/api/mux.go#L284

This was done to make it easy for health checks to always succeed but at the same time this leniency can be trappy.

It will accept badly formatted authentication headers and return 200.

```
curl -H 'Authorization: ApiKy badformat' -i https:/***.apm.us-**.gcp.cloud.es.io
```

It will accept expired authentication keys and return 200.

```
curl -H 'Authorization: ApiKey ' -i https:/***.apm.us-**.gcp.cloud.es.io
```

While this makes health checks easier as it lessens the requirement to provide authentication it will also return erroneous results to health checks that are explicitly set up to include authentication.