Authenticate usage of per-session proxies -- set a session ID cookie when the iframe is first created and verify it on subsequent requests.
Implement login, support multiple users, be secure.