Quote Originally Posted by yatesco
To make it a *little* bit more difficult, make all your controllers only accept posts instead of gets. Anything entered into the URL in a browser is sent as a post....

To be honest, I think it would be better for you to deal with the security issue instead of ignoring it This all seems very fragile and a bit nasty
Thanks. But this solution is not acceptible in my circumstance.
It could also be spoofed. For example, Canoo WebTests can send a POST request to any url once authenticated.