Is this really ok for CR scheme..?
It means I think, that for the period the user is trusted, a lookup will succeed without any authentication..
Which makes CR vulnerable by knowing which users are active..