Hi Mike,
I'm pretty sure this is not an issue as niether the username nor the api key are secret items. If they were then the flickr api would not have us use them as query string params but would make us post them as form params and even this would only be secure using ssl.
For anything other than getting stuff marked as public, ie any commands require that you get what they call a frob from the api and encode it with the secret (which is different than the api key itself), then flickr issues a token to use for api calls.
http://www.flickr.com/services/api/auth.spec.html
Hope it helps,
Joe