[marcosdumay]

The situation is greatly improved if you make the link short-lived and if you put the non-public data in a region of the URL that expects non-public data, like in the password, as in "https://anonymous:[e-mail]/u...".