Which is a stupid idea for something where there is billing involved... Anyone on the internet can take that key and scrape the Google maps API (faking the referer header) and cost you $$$$$.

Google should have simply done with by origin URL if they wanted stuff to be open like that.

Once upon a time Google maps loads were nearly free, and there was no way to restrict that key.