If there's no key set, don't try to get a user

Sanity check against accidentally returning a user that has no API key.
Merge pull request #2193 from danielbachhuber/prevent-user-no-api-ke

If there's no key set, don't try to get a user