Webform integration: Load submission from uuid or webform_submission:token

It would be quite useful to add a parameter to the query string so to be able to load a webform submission from the
webform_submission:token (- the secure token used to look up a submission) OR the submission uuid instead of the entity_id.

because with the current pattern:
/fillpdf?fid=1&webform[nid]=3&webform[sid]=4
combined with the Publish any pdf permission someone can browse/download all the submissions/pdfs by changing the id's at the url.

Thanks for the great work.