pull down to refresh

It seems like that would be a lot of added risk for the attacker with very little gain.