looks like there's a password on the plugin it uses (it's optional though, and it resommends it specifically when putting the API online, which is probably slightly more secure)