I don't see a hole to close -- cookie and fkey, that's all that's necessary

cookie for auth, fkey for XSRF protection

also note that this has long been working like that in greg's IRC bridge :)

@balpha that's great news! :-)

The hole I mentioned was, the same cookie and fkey can be used from a different IP address, which is the difference between my and Greg's implementtaion

My XMPP component isn't running on my local machine, it's running in a datacenter, yet, it can still post messages as long as it has the fkey and cookie. So that's great, makes my work much easier!

@balpha Awesome. Then XMPP write support will soon be appearing in an IM client near you!