auth_token in URL
The button "open in new tab" links to https://pad.example.org/p/pad-misc?&auth_token=<auth_token>&userColor=#ccc&userName=user
.
Why not just on https://pad.example.org/p/pad-misc
?
The auth_token should not be visible in the URL.