Sorry,

I've turned it off by default.

>The first problem could be addressed with an announcement to (at least)
>current-users.  The second is far more serious, and I feel is grounds to
>seek some other way to get the desired capability.

tech-security is probably appropriate.  As I said, I've turned it off
but would like to leave the code there for people to see and try.

Given that this is really only useful to folk with large userbase I
see no problem with it being off by default.

--sjg