[Zikes]

Presumably the ASP could be intercepted via MITM, when it's being passed to the application for which it was generated.