removed form_api_users from schema
added regeneration and tests for api key
added 404 response for invalid mission
restricted users list for protected mode to mission or admin only