[snarfed]oh sure, of course you can. my point was that you shouldn't. a capability URL is effectively the same as a password, it grants access to something that's not supposed to public, or wider access than the person/people who originally received it
