It's a fair complaint. I'm not sure when we're getting everything to HTTPS, but I know it's on the roadmap. Including the API key as a parameter goes back to the early days of our API - quite a few years ago. The problem now is that we have enough apps with enough traffic that we can't just move it to the header without causing a bit of disruption. But that too is on our roadmap. Both issues are important.