good question (was wondering if anyone would ask). I'm #includeing a Suitelet URL that produces additional XML to be appended to the PDF. Because #included stuff needs to be set to "Available without login" I want to have a rather primitive hashed version of the internal ID included as an argument on the Suitelet URL, just to prevent any nefarious access to the content that's returned by the Suitelet.