fix iq spoofing

Save 'to' attribute when sending iqs along with 'id' and check against
'from' when receiving and handling reply.

*untested*