turns out this was first reported in May but that bug report was hidden as a security bug. But not fixed.
Not a member of The Register? Create a new account here.
Remember me on this computer? Post anonymously?