-> GET /report
  status: 401 - missing or wrong API key
-> GET /report
  status: 200 - the secret report