http://example.com/limit-updates/?update=%file%&pkey=%urlargs%
is not sufficiently safe for my system.
Would you care to explain that?
Limiting updates on your server (based on some unique customer ID) is by far the best method to limit updates. You can also do it from within your app, but a sufficiently clever customer could work around that limitation.