start tracking API key use for the json endpoint (in advance of possibly ditching the feature), add a test for the format