Safest approach is to validate the user for the current domain.
github.com
This commit seems to explain it, I think Mark implemented some sort of user security to the sync/reboot commands. I can't quite grasp it, but it looks like it's checking to what extensions the user you're logged in as owns.