Precisely. URLs are not secrets. Browser plug-ins can leak them, they get logged in every proxy's log files, they show up on people's screens, they get emailed in the clear, they get bookmarked, they are easily sniffed...