@Dev: Any "static" identifiers can be spoofed. If an algorithm can be derived from the url, a software "device" can be created to execute a variant of the "Man in the middle" attack. The best type of protection is one where a human is forced to interact, because a computer can not use an algorithm to decipher the question. :MJ