should we also have a security warning here that one should not pass security relevant parameters in this case? its kind of written, but it could be stated more clearly imo. securing the url is one thing, but not exposing sensitive data is just as important.