Comment by tptacek

It depends on where you allow the substitution to occur in the request. It's basically "the big bug class" you have to watch out for in this design.