The API just returns coordinates to the website and it's fairly easy to spoof on major browsers. You'd just need to know where the classroom is.