Well spotted - I should have said "available throughout the handler".

I've corrected the original post. The code works fine, BTW; It's that specific security hole that I'm interested in.

Steve Collyer