API for private data

[doug-leasure]

We need to prevent non-public data from being accessed via API. Should we block these requests completely or should we make a key to provide restricted access to all files for a given non-public release (e.g. /COD/Population/v1.0/*)?