Graham Lawton is a staff writer who has worked at New Scientist for 24 years including as features editor, deputy editor and magazine editor. Nowadays he mostly writes features about life sciences, ...

The simple fix is to add the missing request validation. Consideration will need to be given to the backwards compatibility policy. This definitely seems justified for the username but no password ...