Allow API to be accessed as an argument within a webservice when strict domain checking is enabled

I have come up with the use case where I feel we need to make a small change to the way strict keys are coded. Basically I'm setting up a webservice which stores data based on a by client location. Given what we have at the moment the domain has be passed in as a seperate parameter. This provides a security hole as I can pass in my valid hash and then map to a different domain.

The patch attatch allows the key to be accessed as an argument in the under lying webservice call but doesn't change the signature for the webservices module. That way all routing etc is based on the value.