title: Permission Denied from Firebase using curl and javascript
body: <p>I have a Firebase with a security config like this:</p>
  
  <pre><code>{
      "rules": {
          "serviceproviders": {
              ".read": "auth != null",
              ".write": "auth != null"
          },
          "bookings": {
              ".read": "auth != null",
              ".write": true,
              ".validate": "newData.hasChildren(['phone', 'time', 'date', 'apikey'])",
              "apikey": {
                  // only allow valid apikey
                  ".validate": "root.child('serviceproviders/' + newData.val()).exists()"
              }
          },
          "status": {
              ".read": "auth != null",
              ".write": true
          }
      }
  }
  </code></pre>
  
  <p>The idea is that users can only post <code>/bookings/</code> with a valid <code>apikey</code>, that is, an <code>apikey</code> that can be found in <code>/serviceproviders/</code>. </p>
  
  <p>In the Firebase simulator, this works as expected. However, when I use <code>curl</code> from the terminal, or Javascript from a html page, I get <code>error: permission denied</code> back from Firebase. I send exactly the same data (copy &amp; paste).</p>
  
  <p>My <code>curl</code> command looks like this:</p>
  
  <pre><code>$ curl -X POST -d '{"phone":"004512345678", "date":"2014-07-31","time":"10:00","apikey":"AA227D80-122C-4E5D-AEDF-24A829FA6403"}'  https://example.firebaseIO.com/bookings/.json
  </code></pre>
  
  <p>And I get back:</p>
  
  <pre><code>{
    "error" : "Permission denied"
  }
  </code></pre>