On the other hand, this is such a glaring security flaw that it's hard to have much sympathy for Microsoft (or Microsoft's infamous legal department), since this could cause significant problems for a merchant. The people deserve to know the truth. ;-) Thank you for making this public.