Capability URLs grant access to a resource to anyone who has the URL - w3.org 
There are times when this is useful, for example one-shot password reset URLs, but overuse can be problematic as URLs cannot generally be kept secret.
See recommendations for good practices for web developers who wish to incorporate capability URLs into their applications - w3.org
# See also - Capability Based Security - Cap’n Proto - Wiki Identity Provider