Or the attack just skips the secure hash check on the server... This example doesn't seem to hold water either.