I explain better, basically, we have 3 use cases in order of priority:

1. OWUMS need to temporarily login a user that is verifying with gestpay credit card and he has a "verified by visa" or "mastarcard secure code" card in order to allow him to reach is bank's website.

2. OWUMS needs to automatically login a user after he has verified his account with his mobile phone or credit card. This is a feature that improves usability which we discussed few times in the past, you remember? This already works well on owtb1.

3. We have a guy, Adriano Di Giovanni, developing an experimental Android app which through this API will let users to automatically login into the captive portal if they choose so.

So, to summarize, the first 2 cases need to specify the ip address of the user, because the server is doing the request, not the user. This is why at the moment there's an authorized_ip array configuration. This could be changed to a basic HTTP auth. The point is that only authorized sources can login and logout specific ip addresses.

In the third case, the ip must be assumed from the client and is infact what I have done in the commit 4e11f1c in order to let Adriano go ahead with his work. He will test it on owtb1.