I've implemented changes to the PR https://github.com/apache/incubator-openwhisk/pull/4284 for backward compatibility --- such that, actions which do not have the annotation will still get the api key injected.
The annotation is added by the controller when an action is created or updated unless already present. The default value for the annotation is "false", meaning no key is injected to the action context. Furthermore comments and feedback is appreciated. -r
