API keys should be bound to an origin

[tomayac]

To make key abuse harder, API keys should be tied to an origin, so if one signs up for https://example.com, the provided key would not work for https://other-example.com.