Hi @almonwork, 

I'm not sure this is correct.

Sometimes users submit render URLs with p_auth token, but we don't validate the token for render URLs and we don't need to change the URL.

That's also true for p_p_auth token which we sometimes add to control panel portlets links generated outside of control panel, but again, it's not checked, because control panel portlets have different authorization policy => we shouldn't change the URL.

I think we should only limit the check on action URLs so that we won't create regressions. What do you think?

Thanks.