I don't see any validation of these attributes, could a malicious user set them (via the API or form POST) to gain access to an org of which they're not a member?