[auth-emulator] Cannot provide API key in header

[rhodgkins]

[REQUIRED] Environment info

firebase-tools: 11.15.0

Platform: macOS

[REQUIRED] Test case

Start the emulator in auth only mode:

firebase emulator

[REQUIRED] Steps to reproduce

Following call succeeds with API key in the query parameters:
curl 'http://127.0.0.1:9099/identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key= EXAMPLE' -X POST -i -H 'content-type: application/json' --data-raw '{"email": "test@domain.com", "password": "password"}'

{
  "error": {
    "code": 400,
    "message": "EMAIL_NOT_FOUND",
    "errors": [
      {
        "message": "EMAIL_NOT_FOUND",
        "reason": "invalid",
        "domain": "global"
      }
    ]
  }
}

However trying the x-goog-api-key header it fails:
curl 'http://127.0.0.1:9099/identitytoolkit.googleapis.com/v1/accounts:signInWithPassword' -H 'x-goog-api-key: EXAMPLE' -X POST -i -H 'content-type: application/json' --data-raw '{"email": "test@domain.com", "password": "password"}'

{
  "error": {
    "code": 403,
    "message": "The request is missing a valid API key.",
    "errors": [
      {
        "message": "The request is missing a valid API key.",
        "reason": "forbidden",
        "domain": "global"
      }
    ],
    "status": "PERMISSION_DENIED"
  }
}

[REQUIRED] Expected behavior

For the API key provided in the header to work - see https://cloud.google.com/docs/authentication/api-keys#using-with-rest

[REQUIRED] Actual behavior

It doesn't and must be in the URL