isn't it more secure because the apikey is not exposed client side?