Security concerns on remote on-demand camera for free

Hi, I guess I am running into a situation that someone else might have
already experienced; but I did a search, ended up with no direct
solutions.

My goal is to be able to turn on and off the camera
on-demand remotely; and do it for free. So I set up a dynamic IP
address, along with a port pass through on my router, so it works. Since
I want to make sure it's truly on-demand, ie, nobody has to press
confirm on the Android device, I disabled that option too. So everything
works with one thing: now anyone who happens to know the IP address (or
the domain name) along with port can potentially login and turn on the
camera, and even other things - I don't have anything important on that
Nexus 7 (2nd gen), but having that thoughts just makes me sick.

I
know the right answer is to become a paid user, and at the price of
$1.99/month, it's something I can definitely afford. But I still wonder
whether there is an alternative. Ideally, I want to be asked for a
username/password or just a password before I can access the remote
desktop.

Not sure whether AirDroid should shut down this backdoor - is it even technically possible?

Thanks.