Yes, document.location can be faked.