Passing parameters in URL

[Alan Harris-Reid]

I have a web-page where each row in a grid has edit/delete buttons to 
enable the user to maintain a selected record on another page.  The 
buttons are in the form of a link with href='/item_edit?id=123', but 
this string appears in the URL and gives clues as to how to bypass the 
correct sequence of events, and could be risky if they entered the URL 
directly (especially when it comes to deleting records).

Is there another way of passing a record-id to a method
a) without it appearing in the URL?
b) without the user being able to fathom-out how to attach which id to 
which URL?

As each link contains row-id, I guess there is nothing to stop someone 
from getting the id from the page source-code.  Is it safe to use the 
above href method if I test for authorised credentials (user/password 
stored as session variables, perhaps?) before performing the edit/delete 
action?

I am currently using CherryPy 3.2, but I guess the theory could apply to 
any HTTP framework or web app..

Any help would be appreciated.  
Alan Harris-Reid