authorization by API_KEY (X-Parse headers)