Notes about the use of a URL parameter as the one time secure token (nonce)