2 ms·

if handled correctly, sure. but it also means that implicit cookie authentication ('ambient authority') is possible and can easily happen by accident