hotspots has to be publicly accessible, but its data probably shouldn't be. Use basic auth or only allow connections from the local net.
