Tightened authentication and permission checks on API keys, user accounts, and public sign-up endpoints