Prevent CSRF
Someone with malicious intentions could probably delete/alter things in a Kresus through CSRF. I guess they could also kind os DDOS it through a lot of re-sync requests.
Even though Kresus does not currently handle authentication this should be taken care of (maybe in the same time as the API?).