Given you implemented it correctly, I would agree with you. A bad implementation would allow for preservation of the URL's parameters ala urllib.urlencode(self.request.params) or similar, which would contain the token.