return HTTP 400 if an API key is missing for geolocate calls

This fixes #82