The pellmon_frame.html works fine here (including shifting 1 to 3 hours), but the ip is not hidden (it's not in plain view in the url bar any more, but every link still goes directly to your ip:8081). You can't both give access to your pellmon server and also hide it. If you can view a website then you also have it's public address.
If you have access to a server somewhere else and can set it up as a reverse proxy to your pellmon server, then that other server will be the visible part. I have that setup myself, with apache2 as the the public server, proxying access to pellmon on my raspberry on an internal ip. There is a piece on how to set up the reverse proxy on the wiki. But you won't get that kind of access from a typical web hotel.
PellMon doesn't really fit the use case of 'giving everyone access to my data' without also exposing your own network to the internet in some way. As for the security of exposing your ip, that is really up to you. I have honestly made pellmon as secure as I am possibly able to, but I am not willing to give any guarantees. "If it breaks you get to keep both pieces" and so on... There ARE some risks involved when having a possible way for an intruder to change your burner settings, but those risks are still there when using stokercloud in my opinion. Not that I consider stokercloud insecure, but when the connection is made there is an open channel and the rest is up to the security over at stokercloud. I guess the main difference is that stokercloud is a business and likely takes security very very seriously but you have to trust them completely, pellmon is made by 'some guy on the internet' but is completely open so you can check everything yourself.
There are some missing parts in pellmon security, mainly that you can't easily use an encrypted transport (https), meaning that your login password is transmitted in plain text. This does not affect security at all if you only ever log on locally, and you can also fix it by reverse proxying through apache and adding encryption there (looks like stokercloud allows but does not enforce https on login so you mostly have the same situation there). Someday I will add support for https transport to pellmon directly, the server module (cherrypy) supports it so it mainly requires gathering all the pieces and working out how to deal with the certificate handling mess.
