"Who am I", "which users/accounts may I access", and "which user/account do I wa...

		prodigal_erik on June 16, 2011 \| parent \| context \| favorite \| on: How Hackers Stole 200,000 Citi Accounts Just By Ch... "Who am I", "which users/accounts may I access", and "which user/account do I want to access right now" are different questions, and it's only the latter that belongs in the URL. I agree that secrets in particular must not be exposed in the URL.