title: Tin Can API xAPI Sending Secure Statements to LRS
body: <p>Something seems to elude me with regard to xAPI. I am going to try and keep this really simple.(and maybe even stupid)</p>
  
  <p>What I understand to be true...</p>
  
  <p>Any Tin Can implemented content can be launched with a launcher.
  The launcher is provides endpoint and auth information
  The endpoint DOES NOT have to be an LRS. It can be a script which then passed to the final endpoint, which is an LRS.
  The LRS, in this case private SCORM Cloud(sandbox), cannot receive statements without basic auth.</p>
  
  <p>What I need to know...</p>
  
  <p>Does the LRS generate OAuth tokens?
  How would someone pass the statement from Captivate, Storyline, lectora files to a the TinCan_PHP for handling secure connectioni to the LRS?
  Why would I use TinCan.JS, when the basic auth information is easily broadcasted to the end user, which could then be used to cause harm to the LRS?</p>
  
  <p>Am I completely off track?</p>
  
  <p>Thanks a lot...</p>