Apparently not under the covers, as my tests shows. This is just one example the auditors used as their attack from client to server. Perhaps we need additional test input here?