If it's a bug then the bug needs to be fixed. If the auth process works as intended it's hard enough to make it not something you could do by accident.