updated routes to validate with api key, still not working