Derp, turns out previous thing I thought may be a security flaw is actually checked for earlier on. Rolling back.