Moved check for api_key into authenticated? method.