https://hackerone.com/reports/4930

Also cleaned it up a bit...