Plain HTTP and passing an API key as a URL query parameter? Yikes!