Currently it's security through obscurity... so not great. I'll make the arduino only accept requests with a token next weekend.

Yeah if you take a look at the arduino code on github it's a super light http server. Currently I just do port forwarding to access it.