URL-based access control can be circumvented 1 URL-based access control can be circumvented Dec 5, 2024