This would work somewhat similar to how dcrwallet generates an ephemeral client cert for decrediton use and passes it through the IPC pipe subsystem.
Basically, dcrlnd would always generate an ephemeral admin.macaroon file and instead of writing it to disk, it would pass it via the IPC. This should prevent any other applications in users' computers from performing calls to the running dcrlnd instance.
This would work somewhat similar to how dcrwallet generates an ephemeral client cert for decrediton use and passes it through the IPC pipe subsystem.
Basically, dcrlnd would always generate an ephemeral admin.macaroon file and instead of writing it to disk, it would pass it via the IPC. This should prevent any other applications in users' computers from performing calls to the running dcrlnd instance.