Dumb idea, IMO. If people can access stuff that they shouldn't, by guessing URLs, then your problem is access controls, not the URLs. Switching to opaque, mean

Dumb idea, IMO. If people can access stuff that they shouldn't, by guessing URLs, then your problem is access controls, not the URLs. Switching to opaque, meaningless strings for your URLs does not solve your problem. URLs leak, they risk being recorded and published (e.g. Referer: headers on weblogs), and so people will find them anyway. You still need access controls and all you have achieved by making your URLs complicated is to create more work for you and your users.