Dear all,
That post with the hack was really old. We have added a sensible workaround in ReadonlyREST Enterprise, so that that when a user is allowed to see Monitoring, the missing credentials are injected by our plugin.
Please see the below screenshot of the latest Kibana 6.5.1 running the monitoring app, sporting multi tenancy and the tenancy selector dropdown menu.