I don't know enough about the CFAA to say whether providing the tools to exceed authorized access counts as an additional violation. But it would be reasonable to assume that creating the tools required (sporadic) efforts to exceed authorized access.
Another practice would be changing the '1' to a '2' in the URL http://www.example.com/1.pdf, since the computer running www.example.com is a 'protected computer', and you didn't get authorization to access 2.pdf on the server.
"Protected computer" is basically any server. The CFAA defines it as any computer used or affecting "interstate or foreign commerce", which works out to be most of the internet, thanks to CDNs and the practice of centralized data-centers.[2]
[1]http://www.huffingtonpost.com/2015/01/20/obama-hackers_n_651... [2]https://www.law.cornell.edu/uscode/text/18/1030
One important consideration is whether your state, local, or national laws consider possession to be prima facie intent to commit a crime. http://lockwiki.com/index.php/Legal_issues
It's hard to picture a 'legal' use for something that is tied to a proprietary API.
Also, TOR was funded with illegal uses in mind. Beneficial to the US government, perhaps even legal with the US, but illegal in their intended application.
In what way is browsing the internet without someone recording your every move illegal? You may choose to use the anonymity for illegal purposes. But you may also choose to use your car or house for illegal purposes and no one says that these should be illegal.
Tor was, in part, made for countries where that is illegal.
As for bans on knives and such, I consider such bans just as unjustified.