I want to lock down my web services so that they can only be called by our client.  I don't want the web service to be called from someone external and grab data out of my system.  I've been racking my brain on how to do this.  It hit me in the last day or two.  I remembered reading a post a couple of weeks ago about the content type within a web service.  I ran some tests this morning and I found that if I called my web service from my ajax client, I was getting a content type of application/json.  With a regular application calling my web service, I was getting a content type of text/xml.  I'll be checking my calls from now on this way.  Its not a perfect solution, but it is a step in the right direction.  I can see how to work around this, but I think this will help.