They could apply a different policy to their web-based dashboard GUIs (if these do exist) than to the web browser.