Re 2221, I just knew :) (actually I'd done all the necessary homework back in April for bug 640). Sorry, I should've caught it sooner, but I hadn't looked at bugzilla in a while. I've added it to my RSS reader now but can't figure out how to get an authenticated feed in order to see security bugs...