now use api_key for all rest and ajax authentications