Hehe. You are asking the right questions. :-)
Thanks a lot for that. But I think this is O.K. as a compromise between security and functionality.  
And yes. I don't have sympathy for an admin who want's to run a hidden spy app ;-)