move api_key to end of signature

This mitigates a possible hash length extension attack. Since the
signature is never exposed to the user, it is unlikely this would be a
problem, but I don't want to take any chances.