by default, all users have an api key now