DR-104: access can be determined by apikey in request headers

reviewed by cesarn