Use signer's map_key when contacting sql-api

Includes testcase.
Fixes #188

lib/cartodb/server_options.js

@@ -285,8 +285,31 @@ module.exports = function(){
             }
             return [req.params.table];
           }
-          var username   = that.userByReq(req);
-          me.affectedTables(username, req.params.map_key, sql, this);
+          var user, key;
+          var next = this;
+          Step (
+            function findUserKey() {
+              if ( req.params.hasOwnProperty('_authorizedBySigner') ) {
+                user = req.params._authorizedBySigner;
+                cartoData.getUserMapKey(user, this);
+              } else {
+                user = that.userByReq(req);
+                key = req.params.map_key || req.params.api_key;
+                return null;
+              }
+            },
+            function getAffected(err, data) {
+              if ( err ) throw err;
+              if ( data ) {
+                if ( req.profiler ) req.profiler.done('getSignerMapKey');
+                key = data;
+              }
+              me.affectedTables(user, key, sql, this); // in addCacheChannel
+            },
+            function finish(err, data) {
+              next(err,data);
+            }
+          );
         },
         function buildCacheChannel(err, tableNames) {
           if ( err ) throw err;
@@ -407,7 +430,7 @@ module.exports = function(){
 
         Step(
           function getTables() {
-            me.affectedTables(usr, key, sql, this);
+            me.affectedTables(usr, key, sql, this); // in afterLayergroupCreate
           },
           function getLastupdated(err, tableNames) {
             if (req.profiler) req.profiler.done('affectedTables');
@@ -671,6 +694,7 @@ module.exports = function(){
                 }
 
                 // Authorized by "signed_by" !
+                _.extend(req.params, { _authorizedBySigner: signed_by });
                 that.setDBAuth(signed_by, req.params, function(err) {
                   if (req.profiler) req.profiler.done('setDBAuth');
                   callback(err, true); // authorized (or error)