User not found, set_role raises exception, access violation... And "URL-Hacking" is no just, it is much more dangerous that "real button clicking" because it can be highly automated.