I'm concerned that - in your proposed approach - we would have to put the ACCOUNTID in HTML (and thus in the clear). My understanding is that the ACCOUNTID should be a server-side secret.