BUGFIX: allow API calls to restricted_access site

if api_key is present on a request, bypass the check_restricted_access method.