PaulPA - 3:44 pm on Dec 24, 2008 (gmt 0)

jdMorgan:

I agree that the security protocol is probably the crux of this case. Which raises an interesting question of how this could be done and maybe give some advice to others as to what to avoid. Here are a couple of things they may have done with the link but I'm sure there are more:

• Included personal login identifier in the URL
  
• Bypassed session ID
  
• Linked to the print version