Thanks, Dan. Yes, you don't even need any effort at all for Progressive Profiling to work. It already does.
If you can iFrame in a marketo page, problem solved. I know iFrames aren't a perfect answer but they do work.
You can prefill with 2.0 by querying the Marketo API and pulling the values, then using form.vals() to populate them.
Sure, if you don't care about it (or your other integrations) functioning when you have a successful campaign -- or when a script kiddie or competitor decides they don't like you, whichever comes first.
Curious what you mean by this?
Edit: oh, you mean someone could exhaust our API limit. I'm managing that in a couple ways:
True, if you throttle it through another service, you can at least mediate the DoS vulnerability against other integrations. Whether you leave your forms service with enough calls per day to handle a successful campaign, especially if there are people with an unhealthy interest in your site, I can't say.
The vast majority of Marketo customers do not pay for more API calls (nor do they understand that there is a shared limit across all integrations). In most cases, using the API for this is bringing a huge risk and shouldn't be done.
More important, it isn't necessary. This can be done without the API via a method I've been rolling out with clients for the past year. I guess I've sat on my solution long enough and I'm going to blog about it soon -- each time I see somebody suggest the API is another time I wish I had publicized it sooner!
FYI this should have been fixed Friday evening 4/8. Please let me know if you still see issues with progressive profiling or known lead behavior.