if user apiKey not registred or if Authentication header not send, throw a 403