As other people have mentioned in the thread, this doesn't protect you from a Force Post request by the merchant.