I'd begin with 2.
At this moment the JIRA information is gathered by using page scraping, i.e. downloading the HTML pages themselves and grabbing the info from the HTML code.
(Using the SOAP API of JIRA seems much more restrictive and requires activating the SOAP plugin on JIRA side.)
I could get the custom statuses through the API, but not really by page scraping. There might be some tricky solution for this, but it seems to me that there is no clean & simple way.
If you really need this, plz add it to JIRA as feature req.
If by 1 you mean JIRA databases that require logging in and the pages themselves are not visible for anonymous users, then Kosmos needs to sign in to JIRA somehow programatically.
I don't know JIRA's authentication in details, so at the moment I'm not sure what's the good way to do this.
Any idea is welcome!