Ideally the ADL launcher as recommended would be preferred. It at least allows us to launch the course using an authenticated token, ensuring that the course cannot be accessed by random users, or by entering any users email in the URL.
Currently we’re investigating if its possible to proxy the connection to the LRS in order to authenticate a token here and pass user details to the LRS, but its not an ideal way of solving the problem.