I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).
However, how secure would an application be if the user's page can be accessed just by the GUID in the URL and there's no login / authentication at all? This GUID is quite long (about 16 characters) and the user base at a time would just be about 10,000. It's also a time-based access (e.g. users can only access this special user page for the duration of X hours).