Funnily enough, someone suggested something similar at work a few days ago and I had to shoot him off the air. He wanted to use URLs encoded in a QR to trigger

Funnily enough, someone suggested something similar at work a few days ago and I had to shoot him off the air. He wanted to use URLs encoded in a QR to trigger an action (say, "use coupon"). No authentication, nothing. The idea has some merit, as we wanted this feature to work on any kind of phone and we only have Android and iOS clients, but the whole idea of having a GET request trigger a change on the server made my skin crawl.