If you look at their demo code it has a username and password right in the javascript source - as you would expect - which means keen users could do all kinds of things.
Instead, serve {client,user}-specific keys from the server on request, or let the user generate them through a signin process in the frontend, say by using the _users database that CouchDB and Cloudant allow.
I plan on extending the getting started tutorial with an extention that does a database oer user when logged in (via persona), it actually wont make the tutorial much more complex and gets very close to what it should look like in production (https://github.com/daleharvey/couch-persona)