remove cookie authentication - an apikey is now required alongside all (non-public) queries