A web app I inherited, for which I do not have the original spec, and initially developed by an outsourced offshore team, had one route that was literally "/obscure/reset_password?user_id=x". A light dawned when I realized they must have been asked to provide an unguessable or "obscure" endpoint for account actions.