Currently target rooms should be public rooms with hidden aliases. This isn't great if you're publishing IoT data that should be kept private (or when security through obscurity isn't good enough).

The proxy should optionally support inviting the virtual users, then joining them, to the target room. Possibly on a per-token basis.