switched from basic auth to api_key auth, closes #1