The ACS authentication system does not implement widely used anti-hacker HTTP headers.

Please see the following links for a list of missing HTTP headers:

http://security.stackexchange.com/q/8480/396
and

http://social.msdn.microsoft.com/Forums/en-US/windowsazuresecurity/thread/eab4b53e-438b-4b20-8933-ae88e2f3610f?prof=required