Form is OK, but you need to do the same check also in XML request (REST API).