If the userid in the URL is derived from the auth secret, then one could argue that these are actually capability tokens, which might gain warner's support :-)

I don't see the point in a half-and-half approach, we should either (1) return the resource identified by the URL, letting auth happen in another layer, or (2) remove this information from the URL entirely.