i think you can use AJAX request from ExtJS to retrieve an authentication token or session. Then set the token in the session and load the iframe without passing sensitive data in the URL.