Prefer param apikey over cookie