don't require api key for heartbeat.

also, fix a corner case where the freshly-initialized db is totally empty.