boolean verifyApiKeyHash(final String apiKeyStr, final String hash, final HashAlgorithm hashAlgorithm) {
        Objects.requireNonNull(apiKeyStr);
        Objects.requireNonNull(hash);
        Objects.requireNonNull(hashAlgorithm);
        final ApiKeyHasher apiKeyHasher = getApiKeyHasher(hashAlgorithm);
        try {
            return apiKeyHasher.verify(apiKeyStr, hash);
        } catch (Exception e) {
            LOGGER.debug("Error verifying hash '{}' with algorithm: {}", hash, hashAlgorithm, e);
            // Swallow it.
            // Bcrypt for example, includes details of the salt in the key, so if the key is rubbish
            // then it won't be able to extract the salt to gen the hash and will throw. If it throws
            // then it can't be a valid key.
            return false;
        }
    }
Fetch the verified {@link UserIdentity} for the passed API key.
If the hash of the API key matches one in the database and that key is enabled
and not expired then the {@link UserIdentity} will be returned, else an empty {@link Optional}
is returned.
stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/apikey/ApiKeyService.java