Isn’t the Client-ID meaningless if its public? People could hijack somebody elses Client-ID and get it banned, no?