removed NULL restriction on api_key column and moved auth back to server