Is It Considered Broken Access Control When Access Relies On Knowledge Of A CSPRNG String