How about:

The file names in the cache are just hashes of the URL. Should be safe enough absent malicious collisions.

Keeps the ideas, but not a question anymore.