refactor auth slightly to not redirect when using api_key