Further touchups related to the prior commit

Added the necessary param from previous commit to the other place
buildScope is called, and added a comment to explain the security issue
around listening to POST for the unlocking value.