added simple key mechanism. if the supplied key param is authorized, we supply the fields in the auth_only_fields otherwise, we mask them