Locking down query string parameters to an API Key