I'd be happier if we either used some kind of opaque dashboard identifier here or had a second renderer that used sharing identifiers for widgets so that we could put this one behind the same auth as the non-shared dashboards. I don't want to leak data to people who guess dashboard and widget names, especially since we're likely to have lots of similar dashboards for different projects.