this won't be very secure using a URL variable. any body could add the URL variable to gain access.
The page access uses a security assist access rule that is based on a session variable set at login. you can create additional access rules and use the security assist show region to show the content if the access rule is met.