Why don't you do a: GET /05cea4de-951d-4037-bf8f-f69055b279bb HTTP/1.1 Don't you think if it was another party they would just have encoded the IP and/or MA

Why don't you do a: GET /05cea4de-951d-4037-bf8f-f69055b279bb HTTP/1.1 Don't you think if it was another party they would just have encoded the IP and/or MAC into the URL to of a GET from some scary IP instead of using a cookie to a resource that is actually there on listening on the server.