Apparently the 403 handler needs to actually remember to set apikey.needs_apikeyinfo, oops