only put wc-api key on the urls passed to barclays - not on the url prior to payment