fake security of REST resources implementation.
ignoring apiKey from returning back to the user.