Been away for a bit, but I had to reply to this
Security through obscurity doesnt work.
All I have to do is use a simple program which gets the url without displaying the html as html, but shows it as plain text.
I then see your frame src tags.
I then look at each one in turn and load each using the same program till I get a HTTP/1.0 401 Unauthorized response.
Bam
Give me your main url I guarantee a way in in 5 minutes

.
Sorry if I destroyed any illusions...security IS an illusion 99% of the time