Comment by alexdns

so this parameter can be passed by the attackers also thus making your point pointless