Thanks, I'm reverting it now. We have a bit of a funny model: we want requests from bono to the trusted port to get challenged, but requests from ASs to the trusted port to _not_ get challenged.