renamed middleware 'auth' to 'api-key'. using SET of keys. will need to add auth later.