I think I understand now. Instead of giving out a URL, you just want to give out the data. So even though you need to be authenticated before recieving the "Location", you can still pass on the URL that is returned to your friends... Still, I would not call them as "good as public" - it depends on the users integrity, no?