a bunch more work on tor:

 - be much more careful with session IDs, cookies and CSRF's
 - make a tor paranoid mode which doesn't post anything to the server (or look for yourself)
 - some nicer warnings