Web CRON should be disabled by default

I realised that the default settings for cron over web is enabled, and without password. Googling a bit proved that many sites did not disable the web cron, probably because it is not common those days to have a web cron. I think that new installations should have that setting turned off, or at the very least have a random hash as password.

The Web cron can be abused by attackers to:

• Obtain information only available to logged in users, or in a context restricted to the attacker
• Obtain information useful for attackers (IDs, file paths, etc...)
• Potentially create overload on the server
• ...

You get the idea.