update to setup flow, and requiring apikey only now, we get userid from /me endpoint