The only thing I really wondered about was whether disclosing this new date would leak anything to an attacker. But, if the session is TLS-protected you're good and if it's not well you can get the actual message so whatever. Can't think of anything else. PS - When I first read the subject line I was like oh interesting we're doing something cute with the "savethedate" field :)