Is this only needed when something tries to forge a hash request directly?