I am not advocating security through obscurity. I am saying that your advice is appropriate for users (who cannot control what the server does) but inappropria

I am not advocating security through obscurity. I am saying that your advice is appropriate for users (who cannot control what the server does) but inappropriate for servers (who cannot control what the user does).