How exactly do you close the API to outside requests? It's not hard to reverse engineer most APIs, either by decompiling the app or just watching the wire.