You're telling me that, basically, an attacker says "you've already said you trust me" and the server answers "sure, I did"? Wow.