notably after `ensureCurrentUser`. We don't want to send back the api key unless when it's absolutely necessary.