Makes sense, but that basically guarantees that those events are insecurely treated by clients. My method doesn't make it inherently more secure but it certainly makes it easier to make it more secure...