added API key validation middleware