updates to apikey auth and routes