There isn't a direct way to disable the authorization function, that I know of, aside from changing the user's password/PIN in the directory. If you're integrated with Active Directory, I think the user could change their PIN from ccmuser given their Active Directory password, so this isn't a good general solution at all.
You imply that you have Cisco IPCC or IPCC Express. Assuming you have the proper licensing to do database dips, the right solution would be to maintain a database of authorized users. Once you've collected a username and PIN and verified it, you can then check the database to see if the authenticated username is authorized to perform the function they're invoking. If you don't have the licensing but your list of authorized users is small, you can hardcode a list in the script or make them adjustable script parameters.
