A couple of notes on Authentication:

- Including the clear text API key in the URI makes it very easy for anyone listening in to gain unauthorized access. To get around this, one can either enforce HTTPS, or require a hash of a pass phrase.

- Another option to look into is Kerberos.