Yes, we recently added that restriction. The reason is that POST requests in our system have strict error checks, and some API users were not sending the correct syntax.
Your key is protected, because all API requests are using SSL. SSL protects the entire http request, including the request url.