It actually doesn't totally avoid the issue, because you're still leaking information unless you use a different ID for every request. Someone looking at refer

It actually doesn't totally avoid the issue, because you're still leaking information unless you use a different ID for every request. Someone looking at referer logs can see that you accessed two different things from the same folder. There's also the u= parameter which tells which user you are. That _is_ obfuscated, but it has the same correlation issue, it's the same for forever for a single user, so you could tell that it's the same user looking at different URLs. (we use the u= parameter both for supporting multiple concurrent logged in users on the same machine, and as an extra layer of CSRF protection)