Maybe require a user login first? Its easy to check if there is user login in an eID script. That way only users with a valid account can get data from that eID.