I noticed the controls were enabled, then disabled, requiring a re-auth or re-token add. Presumably this is because some users want to allow 3rd party access to their TeslaFi account, without enabling them the ability to control their car.
If this is the case, a suggestion would be to also either mask a portion of the Tesla Token (e.g., all but the first and last few characters), or hide it all together. While it would take a bit more than a casual user to install the utilities to enable honking the horn, unlocking the car, etc.., exposing the token would enable that to happen to anyone who does have the user's TeslaFi login.
Customer support service by UserEcho