Allow authenticated users to access api without key

Fixes #2817