actually start mandating the presence of an API key

though we don't yet specify the key format, we already do check for the
presence of a query string