I think you defined a reference object as an absolute and associated with finance. How about the following: You are a software vendor, your sw if sold online after a visitor purchases it. Wouldn't you prefer that ONLY the purchaser be able to access a hyperlink for your product?

Forget the financial (banking sites) or even software, what about say a social network. "Back in the days" if you sniffed the wire, it was a known fact you could pull out the URIs from the tcp capture, open it in a browser, and you had instant access to email, social network components, etc.

There are plenty of different scenarios you'd need it. Think about it for what it is: "Insecure Direct Object" an object directly accessible and cannot be secured for whatever reason. We need to secure it by assigning it a "reference" so it can never be "directly named."

How do indirect, session-specific resource tokens increase security?
In my 'act' I want to capture an exception so that I can do multiple tests on the exception data.  Examples on the web show how to capture and compare the type/message within a test (or 'It' block) but not how to capture the exception as an 'act' in itself.  

I am currently just doing a try/catch within the 'act' body and storing the exception within the context for later testing in the 'It' block.  There I can perform a number of different fluent assertions on the data.  Is this the best approach? 
