fyi, the http error line (if I return a 500, say), is echo'd exactly on the demo page -- ie cross site scriptable.