You mean "we assume it did not come from a browser and therefore we do not need to enforce the same-origin policy", right?