Would it be possible to require a key within a different url parameter? That way, one would need to know both the name and the api key of the field to edit/delete it? A key would be generated and returned in response to the initial creation request.