[avolcano]

Sadly, if they tried your first suggestion, Spotify would almost certainly lock down developer access like Twitter has for their new API, requiring an application and manual approval.

Login/password and scraping is a more interesting alternative, but then Spotify would presumedly block any server-side scraping. Really, best option I can come up with is browser automation that is entirely client-side (whether a browser extension or maybe wrapping Puppeteer).