Yeah it's a possibility though presumably as much as leaving any of our server-side pages open.

There is a question around do we need a more fancy system for expiring these as a single server-page provided token would be needed for all the SPA requests.