Strip api-key param from capi queries

Refactor as a general sanitiser for capi queries.