better user api key validation