`get_stat_user` includes API call

The `get_stat_user` API endpoint performs at least one API call through `update_user` but is not scoped to use the API key. And the function also does not handle when the signed in user does not have an API key.