Encrypting URI Segments

[eluser]dblackherod[/eluser]
i just realized that:

controller/users which lists all users for admin group can be accessed by a less privileged user who should only be able to edit his/her profile via controller/users/id/7 by simply traversing the url to read controller/users.

one might argue that this is a design approach error and a simple method call in the controller's constructor to check whether the logged in user is a member of an authorized group should sort this out but NO!

what happens when the same controller needs to be accessed by both groups but the functionalities for both groups should be isolated? i.e. controller/settings/others can be sccessed by every group but controller/settings should not.

besides the controllers to be edited are so many all that refactoring is too much work compared to fixing up a brilliantly simple library and helpers to obfuscate the uri segments