All API routes now return with JSON "Invalid API Key" if wrong