Kind of, the deserialization would fail at line 54, but I agree that we shouldn't allow that kind of tampering to pass the hmac check in any case.

Perhaps the best approach is to push this all into the cookie jar thereby not adding risks that we subtly mess up a cryptographic API and end up having to do a painful security release.