Does supertokens support authentication via an API key? i would like my app to be API first so that the UI uses it (and thus would accept the cookies from supertokens) but they could also send an api key in a header. what is the pattern typically used for this if you are using supertokens?