prefer api_key_user to cookie user