The API is the same for all the models. This whole reuse/rebrew matter is simply due to the session parameter being issued after one is requested when you start to brew. It's likely a bug if its permitting them after the session is complete as that's what the code=(integer) is at the end. As far as what I see from the unit, it's obvious how it works - because all these devices use radio, they are required to be registered with the FCC. It's clearly NFC but all that does is read your tag, check what receipe its for and brews it. It does not appear to have any data associated with authorization.
From what I see, one could essentially just run the responses with a Raspberry Pi running CherryPy with Ngnix or something. You would also of course need to have a decent network where you can run your own DNS internally to send pico brew.com to something like 192.168.0.0/24 or whatever your network range and or octet assigned to the host that will essentially respond with the same requests the PicoBrew is expecting to continue it's brew.