I wouldn't bother basing a security decision on a field whose value is supplied by the client you're not trusting in the first place. ;)