Since this value is used both for identification and authentication, it shouldn't be in the URL where it might be logged or otherwise discovered.