And, of course you can also create your own pre-authentication CGI using PHP etc... which would be trivial.
Yes, I can see how its possible to create a PHP proxy in order to hide the user/password (i.e pass the JS variables to PHP which adds the user/password and performs the request to the mediaCloud). I strongly advise creating a 'limited account' user like you would do with the RemoteTouch in any case. However, this does not prevent mis-use of the interface if it were available on a publicly known URL – for example anyone with the link could update the screen from anywhere at anytime (i.e. multiple people passing variables to the screen at once).
My assumption (based on the above) is that this feature is primarily designed to be used where the controller UI is
not public, which is cool. But anyone trying to implement this feature should be aware of it's indented design so as no not expose any of their account credentials.
@admin – have you thought about a way that we could retrieve an authentication token from the API, so as to create temporary user sessions for the UI? The token could expire after a given interval (or when a session is terminated by a user - e.g an endSession function), so the UI would have to re-establish 'trust' to perform another command. Sorry – quite a vague example for something quite technical to implement.
