I think they have a way to get the download url for the mp4, but I don't know that deriving the iframe src from that is any cleaner. The email I have from @nicolaasmatthijs after I asked about this says:

   Soon mediacore will support requesting a pre-signed embed code. But until then you'll have to extract the src, sign it, and put it back into the embed code.