By spec, it should be. We used to prevent this by comparing the request URL host and running app ID.