enforce key for all requests