added possibility to authenticate via X-Api-Key header