What is the recommended way of using the kleber methods in client-side AJAX calls without disclosing the requestKey? Unless I have missed something having my requestKey available to the client-side could result in anyone else using my requestKey for their purpose (while I pay for it)?