Made the security decision to use the API Key within the JavaScript code rather than separate it to a proxy server that acts as an interface between the web client and Riot Web Service, because it's more valuable to keep it here for now. If it becomes an issue at any point, it can always be refactored out.