It would be good to have a hash as part of headers, otherwise this is not an acceptable risk by default.