scaling issue if end-user is requestor
major cross-domain trust matrix required
if you (the organization) sent it to me, it must be from you