I've ran into this too... their security team came back with "That's by design".

Not too long afterwards a friend of mine automated it, stuck it up on Google code and it might be fixed now ...