It's the same kind of exploit that plagued many web games in the past; it's just something most programmers do wrong, because it's not a requirement in most cases.