I have a link on a view that opens a modal form. When the form closes, I need to ajax rebuild the view. To accomplish this, I've added a url query to the link to create an ajax replace response containing the correct view. The problem I'm concerned about is that the string contains the view id, display id and arguments for the view and is viewable by the user. How should I protect this string so that I can be sure the one I get from the user is the one I sent to the user?
I would prefer to not store a token, but I can if that is the best solution.