At the moment authorization relies on the secrecy of the unique address, yes. I wanted to keep it simple. As long as you don't share that address, which is close to impossible to guess, you should be fine. Is there something else you would recommend I implement, that doesn't impact on usability? Thanks!