try a different fix, this forces the controller to use the API key on POST item requests