[tptacek]

It depends on where you allow the substitution to occur in the request. It's basically "the big bug class" you have to watch out for in this design.