[dmurray]

The bad guys can do exactly the same in the workflow where you redirect them rather than update the page.