I created a Vapi Private Key with restrictions on specifying the assistants that can be used, using this key I am creating a jwt token and creating a Vapi instance for web, but I am able to pass and call any assistants custom assistant config