That's the winning point to this discussion, imho. I don't have any security needs to obfuscate the userID, and I have programmatic protections against abusing the url's (such as comparing userID to session.userID for authentication, etc, etc).
If I'm going to have 100million users (hypothetically), having GUID's as the primarykey and running indexes on that could be a game changer when compared to the smaller INT type.