Deprecate passing of DIS client API key as "api_key" query parameter

[craigpratt]

The API key should be passed as a header instead of query parameter

Note that this needs to be coordinated with support on the backend.

[Chadyshack]

This depreciation is in progress due to our changes in middleware. Once were confident no one is using it then we can get rid of the middware change (and maybe a few other optional query params on some endpoints for api_key).