This one is a little more concerning: what if a model error message includes the user-submitted value? But this is for the admin interface only, and I'm not sure if we have model error messages that do that. So it's probably fine (it's certainly been like this a long time already).