removed api key from controller