I did not see the functionality implemented into the hosted CIM as you inquired.
Yes, ideally a method should exist to better restrict the CIM profile management when using the hosted CIM.
For instance, as a quick "feature request", you should be able to specify a set of allowed activities in the initial token generation request. Currently, anyone with any background knowledge of the hosted CIM, would have free reign over their CIM profile. Once their token is generated, and live for the next ~15 minutes, the individual can add/modify/delete their CIM payment and shipping profiles without restriction. Specific permissions should be defined with each token request, maybe only allowing the creation of a new payment profile, etc..
In the mean time, I would recommend the use of CIM API calls as opposed to the hosted CIM. Just my two cents.
