Sure, but that falls under the "no unauthorised GET data" thing I talked about...?