I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user poste

I have seen some similar code. After authentication, a parameter was passed into the URL. Basically, if you had that token, you were logged in. Some user posted a link to their page on some site and included that token. Later, the user complained about all of their photos constantly being deleted. Photo deletes were GET-based and did not have no-follow. Google eventually indexed their logged-in link and was happily deleting all of their photos daily. Fun times tracking that one down. (It was a code base that I inherited.)