The "user" cookie contains a base64'd username, the JSON responses include an echoed User-Agent, and I can rotate the "roomids" parameter to retrieve message logs from arbitrary rooms. Does security matter for this app?
Still, it'd be worth putting up a notice somewhere that users can't expect privacy from this site.
As for the room IDs --- randomizing them is a fine bit of rubber-chicken security. I think it's a good idea. But the right solution is to allow users to erase the chat logs, and to verify that users have access to a given room before dumping all messages starting at message ID 0.