WIP - use basic auth as first step
working, but api_key sent in params