Yes, I was thinking along the same lines as you (I think). Nothing but the browser will be able to read them. I guess some no-cache crap that IE may or may not honor could work. But why the need for them to be dynamically generated, and client side too?
I think we deserve an answer to this mystery. It nags me. :D