This is unbelievable. Any decent API would have the client authenticate via user credentials over an encrypted channel to obtain a temporary token (that's only

This is unbelievable. Any decent API would have the client authenticate via user credentials over an encrypted channel to obtain a temporary token (that's only valid for a short time period), and all subsequent command requests would require the token to successfully proceed.