I didn't email you about this because I didn't think you'd done anything
which needed to change: you fixed a bug, and that's great. Obviously you
knew these fixes had security implications because you said so, and, to
me, that's enough.
(I *was* being somewhat sarcastic. Of course the fix isn't worse because
of the wording of the log message! :) )