Uh-oh...

fixed it now. only found the damn bug by accident.

not quite as important as the "blog admin panel has no security" one but still something i should have tested.

it certainly could have been. thankfully no-one found it as it was unsecured for weeks