I would like you to secure Hidden Categories. Take this as an option for admin.
1) Set a time. For example I can set up a time range between two specified days a hidden category being available.
2) You should protect with a key a hidden category (e.g.
www.xcart.com/category.php?id=101&hiddenkey=231). hiddenkey is a string defined by admin. This will prevent any intrusion.
3) Based on 2 you can go further using in URL username or group. Having all this I can be sure only those users or groups have access to a restrict area of the store.
Remember, I hidden category is a privilege for a customer. Like a golden cave with good prices. This is a good way to give a mystery feeling to your store. 90% of the customers will appreciate having a special area in a store, only for them, because they are special.