don't require api key for heartbeat.

also, fix a corner case where the freshly-initialized db is totally empty.

@gwprice @e0d