QDbBackedFormState handler will return form states not from the current session. This is a security hole if logins are being used to access certain pages.