update api to authenticate either thru station key or flask user