[scottydelta]

Exactly, the attacker can always not use the browser and emulate a browser request if motivated enough.