If there's no key set, don't try to get a user

Sanity check against accidentally returning a user that has no API key.