There were cases when such private URLs got into search engines. You should protect such URLs with authorization or at least hide them behind a POST form. Or block them with robots.txt.

Also if a user follows a link from such page, the URL would be leaked via Referer header so it is not secure anyway.