Hi,
for the scratchpad this is managed in the pb_select_template() function. You can find this function in the profile_browser.js file
You may want to look to modify/add QBE there that construct the link.
you can then use form group associated to roles to manage to who this will apply or manage it there too using if statement
This is less secure than a DP as this running client side ut can already help.
My 2 cents
/J