I noticed when I have a hidden field(used for background processing), when I added a ' at the end of the URL the field became visible to users that were not permitted to view that field.