On the CSRF concern, which is totally valid, I've pushed a patch. From version 0.0.5 it uses a token to prevent this kind of attacks.

https://github.com/codegram/rack-webconsole/commit/d5060d0e8...