title: Authenticating a javascript library
body: <p>Is it kosher to render authentication credentials into a javascript SDK from server-side code?</p>
  
  <p>For instance, in Django templating, it might look like:</p>
  
  <pre><code>&lt;script type="text/javascript"&gt;
      sdk = Sdk();
      sdk_username = "{{ users_sdk_username }}";
      sdk_password = "{{ users_sdk_password }}";
      sdk.connect(sdk_username, sdk_password);
  &lt;/script&gt;
  </code></pre>
  
  <p>It feels a little bit sketchy, but I'm not sure how to authenticate the javascript SDK on the server and pass a token to the client.</p>
  
  <p>The username and password are things the current user of the webpage should know anyways, but not something that should be generally public.</p>