Have written a little Trigger Servlet for Hudson, to enable post commit builds on Google Code projects.
By relying upon a shared secret, it enables pre-authentication of the trigger url; which should only be visible to someone with administrator access to the Hudson job and administrator access to the triggering site, for example the Google Code Administer Source page.