## Bug description

While exploring the onboarding/setup funnel, I found what seems to be a bug capturing events (perhaps it's an API request issue). When I send this request, the events don't get saved (checked directly on the database).

```
POST <host>/capture
```

```json
{
    "api_key": "API_KEY_HERE",
    "event": "Purchase item",
    "properties": {
        "distinct_id": "845555992929291"
    }
}
```


## Expected behavior
- Events should be correctly saved to the database. If on the onboarding flow, continue the user and complete the onboarding.
- If the request is malformed or an invalid API key is sent, I should not receive a 200 status code. _There seems to be an issue with the request and therefore the event is not saved_, however **if I add a random non-existent key as the API key (e.g. `invalid`), I still get a 200 and a 1 in the response.**  


## Reproduction environment
- Tested using the one-line Docker deploy.
```bash
doker run -t -i --rm --publish 8000:8000 -v postgres:/var/lib/postgresql posthog/posthog:preview
```
- Tested on the cloud version with the same result (please reach out privately if you want to know the account's email address).

posthog/test/test_middleware.py
with self.settings(
            ALLOWED_IP_BLOCKS=["192.168.0.0/31", "127.0.0.0/25,128.0.0.1"], USE_X_FORWARDED_HOST=True,
        ):
            with self.settings(TRUSTED_PROXIES="10.0.0.1"):
                response = self.client.get("/", REMOTE_ADDR="10.0.0.1", HTTP_X_FORWARDED_FOR="192.168.0.1,10.0.0.1",)
                self.assertNotIn(b"IP is not allowed", response.content)
    def test_attempt_spoofing(self):
        with self.settings(
            ALLOWED_IP_BLOCKS=["192.168.0.0/31", "127.0.0.0/25,128.0.0.1"], USE_X_FORWARDED_HOST=True,
        ):
            with self.settings(TRUSTED_PROXIES="10.0.0.1"):
                response = self.client.get("/", REMOTE_ADDR="10.0.0.1", HTTP_X_FORWARDED_FOR="192.168.0.1,10.0.0.2",)
                self.assertIn(b"IP is not allowed", response.content)
    def test_trust_all_proxies(self):
        with self.settings(
            ALLOWED_IP_BLOCKS=["192.168.0.0/31", "127.0.0.0/25,128.0.0.1"], USE_X_FORWARDED_HOST=True,
        ):
            with self.settings(TRUST_ALL_PROXIES=True):
                response = self.client.get("/", REMOTE_ADDR="10.0.0.1", HTTP_X_FORWARDED_FOR="192.168.0.1,10.0.0.1",)
                self.assertNotIn(b"IP is not allowed", response.content)
class TestToolbarCookieMiddleware(TestCase):