fix for user authentication for API without key