[jaymzcampbell]

It is using an attribute selector that matches against the last character only - so no giant file of permutations required.

[hughes]

Also, and critically, the server always responds with an HTTP 400 status code. This prevents caching in most browsers, so the request will be made again when a key is repeated.