Add comment on security of calling `contextFor`.