Never trust the client, right? In this case, the client is another server, run by different people. If software A can fuck up software B, software B is the one that should be fixed with better security. Thanks for clarifying btw!