See https://incompleteness.me/blog/2007/04/04/how-to-protect-a-json-or-javascript-service/