consider a rest service with the following calls
POST /api/mails creates a new mail and sends it
GET /api/mails/{id} reads a specific mail
GET /api/mails/{id}/body reads the body of a specific mail
the last get is used by an <a> tag in the body of the email to "view this mail in the browser".
however, I do not want people to read other people's mails by reducing or increasing the id number.
can I add some authentication header to the request done by the <a> tag (without javascript because it is in an email)
(see full text)