title: Firebase - only allow login from app using password & email
body: <p>I'm building an iOS app using Firebase for all data storage. The user creates an account and logs in with password and email. For security reasons, I would like to limit the login, or at least the read and write access, to the app only. I don't want it to be possible for "anyone" to create accounts and access data unless they are using the app.</p>
  
  <p>As I understand it, it's possible for anyone to access the data, as long as they're logged in, if they find out the URL to my Firebase database. This seems like a big security risk to me.</p>
  
  <p>I have of course implemented security rules, but logged in users can still read - and write - data to the database at different locations so basically they could connect the my Firebase database using the Javascript API and then read and write? And anyone can create user's as long as they know the URL to my database?</p>
  
  <p>Is there some way to prevent this, such as using a custom token while still logging in with email and password?</p>