Fair enough. Never trust client-submitted browser form, but always trust LLM-submitted form.