You're right :-) I was actually thinking about for internal scope applicaitons only, but I neglected to even mention it. But even then, the black hats remain such a worry in a very big organization. There was also a mix and match but proved to become "mismatch" when I put the "unless" clause. I should have stressed that I prefer the sophisticated (which is freely translated to user friendly) error message instead of the usual 500 ISE page for public apps for neither harmful nor hintful.