[cap-talk] solve CSRF by making references unforgeable, not unshareable

[lists at notatla.org.uk]

David-Sarah Hopwood wrote:

> References are made unforgeable by making valid representations
> of them either opaque or sparse (unguessable). Representations
> of SQL queries cannot be made opaque nor sparse.

Can things be opaque or sparse but not both?  What would be examples?