add verify_api_key before filter to all controllers