UUID does a lot of that for you already and you know its URL friendly. Its good enough for hiding things behind a URL and being unguessable. Good enough.