I don't agree with that. You can make a jsonp request with some credentials into a private application.