I'm assuming this guarantees that this call cannot be made from the user's browser. Might be good to test for this (I don't think I see any test that covers this.)