The VGUI browser also allowed servers to steal the steam session cookies. So not a very hardened implementation at all.