I would add that you may want to use a custom field or similar to store a unique token so prevent meddling with the url parameters.