Added comment on REST lesson learned: Avoid hackable URLs

PS, I like the intent of pull requests for comments, but it is a bit of a pain.