bugfix: apikey is required for user authentication