Set default error code to 500. Move authentication key check to API route.