0
No, this scheme you propose is not secure, because you are potentially exposing your cross-domain authorisation token in server logs and referer strings on any third-party web servers you'll be linking contents from (or possibly injected by XSS to inspect for request values), if you're passing it...