That's indeed a good example of prior full trusting of the browser by the server.