(Author of the post here). My point is that you can easily make this a complete non-issue by increasing the entropy of the token. 96-bit tokens are 16 characte

(Author of the post here). My point is that you can easily make this a complete non-issue by increasing the entropy of the token. 96-bit tokens are 16 characters in base64url - just 3 more characters than the 64-bit tokens used by Waterken, yet with a token space 4 billion times as large. By way of contrast, Google Docs URLs include a random string that is over 40 characters long.