verify request forms too? audit input sources -- crash/no crash depending on whether the input is trusted?