But most auth implementations don’t bother checking it.