Go ahead and submit it as a patch on Source Forge.
Then post a follow up message to this topic with a link to the patch.
The shutdown.sh does not post a URL to perform the shutdown. It uses the invoker adaptor which by default uses RMI. See the reply I made to the related post in the security forum which already indicated 3.2.4R1 will provide the authenticated shutdown implementation.