I can say that a more detailed answer would have been impossible 
Although, your explanation in some way killed my new development
as some new features were based on running all the calls to Twitter API from each client just to skip charging our servers with tremendous high processing as I would expect from twitter users. Our idea was based on that and everything was good (but insecure, as you said because we were publishing the secret key on the client side) so this restriction as I said killed the project. Anyway, it was good to know that now as we are in the discovery phases and almost no cost were spent.
Thanks a lot for all the answers and we will continue trying to discover how we can do things without authenticated javascript calls…