I think criminalising both is unreasonable, what you do with the URL you accessed or the password you guessed however is different.