Is the idea that the attacker is brute forcing the login method and they are less likely to be successful if the input must be passed in an unexpected format?