I don't know Mason, so I'll only address the second question. You can't give data to the client without the user being able to have access to it.

That said, "removecard" suggests you at doing something serious on the server, so you should be using POST not GET, and that mean you need a form, not a link. (Using links risks bots and precaching engines deleting things!)

If you use POST then the data will not be visible in the URL, although the user can still access if if they want.