Move the apikeys out of the update URLs.

It has to be in the source of course, but it's a little better if it's not right in the url.