Very true, never trust anything that comes from the client, including the request headers.