On second thoughts I see that this is actually OK. I will make a last min change though since we won't get here if the `cookie` provider was used (the _Bad Credentials_ exception).