Security

That's fine - if you apply the battery with the button held down (normal firmware update process) you can totally update the firmware even with the password set - however you can't read the memory back that way, so it's still relatively safe with the password.

You can request bonding with something like this (startBonding) - however you need a very recent build as it only got added a week or so ago (it's not in 1v92). The travis builds have it in: http://www.espruino.com/binaries/travis/master/

var gatt;
NRF.requestDevice({ filters: [{ name: 'Puck.js abcd' }] }).then(function(device) {
  console.log("found device");
  return device.gatt.connect();
}).then(function(g) {
  gatt = g;
  console.log("connected");
  return gatt.startBonding();
}).then(function() {
  console.log("bonded");
  gatt.disconnect();
}).catch(function(e) {
  console.log("ERROR",e);
});

Having said that, it seems to work but isn't properly tested yet