Let's face it. Salesforce Communities is expensive and not for everyone out there. I have a customer who wants to create a customer-facing site where non-logged in users can register themselves and later modify change their registrations.

I thought of using a Salesforce Site for it and not have users have user names and password. I just want them to use URLs to go back and edit their existing registration.

Multiple questions arise:

1. Will Security Review "kill me" for not having proper authentification
2. What are ways / are there ways to do this with user-specific, non-guessable URLs that are send via email?
3. Some URL currently contain Salesforce Ids. Users could tamper them and call other valid Ids. Is there anything I can do against it?

*I'm looking for pragmatic answers beyond "Insecure always use OAuth and Communities".*