added api_key feature
fixed auth issue on first load