It was really just a bad design decision that was exploited. It should be deprecated and removed. Allow it on intranets or some legacy website specific setting, but it should be blocked on the public internet.