tidy
Give more informative error if org does not seem legit
Api key from the session, or the header...