add verification for API key on POST requests