Previously because an API key was only validated if allowAnonymous was true, an invalid API key could be provided and the request would have been accepted, and also if a valid API key was provided it was not used to authenticate the user.