[jcromartie]

While the author of that post is advocating a level 3 API, you could still have unguessable URLs without any hypermedia involved. If the client and server shared a secret key, or if you used random UUIDs as resource IDs, then you could achieve the same thing.