Unfortunately, while a good practice, reading the code is not an iron-clad defense.

http://cm.bell-labs.com/who/ken/trust.html

To give one example of how this could fail, the server could return different code when the request referer is facebook.