Am I right that this is a secondary defense in case the form/action code fails to limit the access?