Definitely do not rely on the absence of a link to protect access to your data. Someone will eventually figure out the URL for the (missing) link anyway. Always check access before each operation.