added apikey model, locked down all requests to require an apikey passed in the headers