This is unsafe. It assumes we do not have multiple sessions. I think it's trying to assert that since we were logged in already, this could only have been triggered by the code auth plugin. No?