Having the resizing api exposed publicly lile in the ajax example is definately a bad idea. The second example (labeled "html") demonstrates using it entirely

Having the resizing api exposed publicly lile in the ajax example is definately a bad idea. The second example (labeled "html") demonstrates using it entirely serverside, which would be fine. That way, only the filename of the cached file is exposed. ...Which was how I did it in the late 90's.