Place API key in headers

At present the API key is passed as a query parameter to the redmine server. This makes it visible in web server logs, and exposes it in error messages when, e.g. the macro parameters are invalid (see, e.g., XREDMINE-5). An alternative for Redmine v1.1.0+ servers is to place the API key in the X-Redmine-API-Key header.