Dont allow anyone to regenerate api key if they have the nonce