Data shouldn't change on a GET for these very reasons.

Therefore, the secret shouldn't be obtained from a GET, but rather a POST. A button or jQuery.post on the 'shared' page, for example, that fetches and causes the deletion.

I like this idea though.