Don't send password as a GET parameter and get api key from cookies