fixed bug where an user record with an empty developer key would allow access to "&dev_key=&" requests