cleaned up auth handler and moved the responsibility of throwing a missing api key exception to the client long before anything serious can be done