security improvements, added API key in config