So when you say "read the key to validate", is Hasura verifying the incoming session for each API request and then passing the user info to your APIs?