It is on my todo list to improve this. At the moment, only the steemconnect auth token is used to identify a user. I'm planing to implement a encryption of a string using the posting key as second way to identify a user.

You can read more about the API here:
https://steempeak.com/utopian-io/@holger80/steemrewarding-com-new-api-functions-and-pause-votes-when-below-a-global-vp-threshold-have-been-added