If you use Verto, you will need to embed the userID and password of a Freeswitch user in the page resources so it can be passed in the $.verto.init(...) call. You can protect this signaling channel somewhat by rotating the password frequently. However, I don't know if there is any way to protect the large range of ports that FS needs to be open to handle exchange of audio and video. I asked here a few weeks ago if it would be possible to configure FS to ignore requests on these ports from all addresses except those that have an active login on the signaling channel.