require api key on GET requests