Updated 9-27-17
I have now been using the Roku app on my TCL TVs for the last couple of months with zero questionable (or remote) logins. Unlike @DLONG, who has been seeing repeated local logins originating from the Roku app, I have seen only a single login when I make the connection from a given Roku TV to the server. I cannot explain this difference, but with it configured as follows, I feel comfortable enough to continue using the app (and even recommend it if others have the same experience I do).
Set each Roku device (or TV) to a static IP address on the local network. I have mine set to .80, thru .85. I use the static DHCP feature of my router (tomato) to make sure that each TV is assigned the same IP every time (though you can manually apply a static IP at the device).
In
Blue Iris, go to golbal settings, webserver, and click on the 'advanced' button at the bottom.
In the first box, enter the IP address(es) of the devices which should have unchallenged access to the BI server as admin. Place a carrot symbol (^) in front of each IP address:
View attachment 22114
Now, when any device with an IP starting with ^ attempts to access the BI webserver, it will have immediate access as admin - it will not be prompted for credentials.
Note: This is also the place where you would add black listed IPs (place a minus (-) sign ahead of IP). It's also the place where automatically blacklisted IP are added after too many failed attempts (if you have that feature turned on).
Now, on the Roku app, add the camera (or group) as follows (for some reason my Moto would NOT focus on my TV):