People used to use the "how would anyone get the url" security model all the time. Then Spiders came along and started find ALL the links that return data.