Wow...thank you, folks for clarifying this.
But this is the method Authorize.Net uses to pass the info to its Gateway ("SIM")...and I just realized...it should only be the user/customer who is viewing the page at that point anyway (and no credit card info being passed).
However, I am going to take heed with some other stuff on 'public access' pages.