Good question. This is a legacy step and I almost pulled it out. I ended up leaving it because in theory someone could actually simulate this request if they really wanted to and it's good to know we're protected, but it isn't a very likely scenario.