handle apikeys as URL parameters, limit SET queries to checking api key"