You have to enable the HTTP proxy in the ASA.  When you do this, you have to use an IP that is open to the public, at least that's my understanding.  We setup Apache with mod_proxy and set that IP as the services IP for the phones.  We can then use a combination of mod_proxy and mod_rewrite to restrict/filter requests to the actual destination (which may span multiple internal IP's).  That at least adds some protection.  Too bad these requests can't be tunneled over the secure session between the phone and the ASA.