Lets move this whole auth section to an "_authenticate_request()" method and let the subclass override for the api key - or rely on the parent deal with cookie, basic auth