Oh, I did add the lj_form_auth checking as a guard against that.  It wasn't in there before.