As you're the managed package author I think you're free/clear of ethical issues despite clamor here. As someone who's "known" you for awhile I find it amusing that the first response to your question was to question your ethics. lol.
Daniel, I think, hit the nail on the head. One of my favorite tricks, if you can call it that, is to utilize the built in salesforce ajax proxy to hit api endpoints via jquery. In this case, you could easily create a custom rest api in apex, then hit that via the ajax proxy.
The gist of using the ajax proxy is this:
var request = this.getXmlHttpRequestObject();
request.open("POST", '/services/proxy', false);
This is a pure js version, but you can easily do the same via jQuery.
Essentially, the key points are found on line 2, 3 and 4.
- Line 2, that middle parameter of '/services/proxy' is required! and
is the url for using salesforces' built in ajax proxy. Using a
relative url lets it work regardless of your instance. ;)
- Line 3, sets the Authorization header that is used by the Proxy to
authenticate your request. the variable 'credential' is the oAuth
token from your session. I'll leave it as an exercise for the reader
to aquire that session token id. Line 4 is the money!
- Line 4's, this.url variable is the effective url for the request. In other
words, the XMLHttpRequestObject's actual url is /services/proxy but
the proxy is going to turn around and forward the request to whatever
url is passed to the proxy via the 'SalesforceProxy-Endpoint' header,
in our case the variable 'this.url'.
I took this example from some of my Evernote / Salesforce integration code, if you'd like to see a version of it with syntax highlighting etc. check out https://gist.github.com/da59b15f827a10fb627e