Changed unauthorized response code to forbidden.  Made it so that using an API key is ok when one isn't required.