Sure it is. The same-origin rule that holds the whole web security model together is entirely a property of browser behavior.
That's indeed a good example of prior full trusting of the browser by the server.
That's indeed a good example of prior full trusting of the browser by the server.