"Warning: The URL is the only authentication. Anyone with the link has full terminal access."
Could you make it so the URL is one-use only, such that once you've scanned it with your phone you can stop worrying because anyone else who uses it won't be able to start a session?
it is indeed disposable and the prefix is like your secure key. it is safe unless someone has access to your screen. I can add an option to permit a single session.