restrict api keys/tokens to registered users