render the user object here: `@user.to_json(include: :api_key)`