Anyone can take the SLEEK_PRODUCT_ID of any site and abuse it

the widget should be restricted to the same origin as defined on the admin side