Key checking for POST requests works for both /users and /locations