whatever mechanism is enforcing this can be spoofed on the client