We use them to restrict access to some static assets (beta documentation) by checking an authorization endpoint. Haven't had any problems--but we're also doing this at a very small scale.