ensure CurrentUser is reset before requests are processed, disable api keys