You'll need to add some auth before_filters or something to this action, otherwise anyone can update URLs with `curl`, etc.