This route is only mounted if `RAILS_ENV = test`. 

Given that, it seems like the biggest threat vector is our own incompetence. If we're going to put more bumpers around this feature, I'm inclined to do something to protect us from ourselves before we worry about being haxed.