Comment 2 for bug 1387372

For reference, bug 1226828 which was closed and not deemed a security issue at the time. Doesn't mean it isn't worth revisiting though, it's good keystone is mentioned since we'll want to be matching behaviour.