>    kenh@cmf> FWIW, I think people expect U2U to work all of the time
>    kenh@cmf> (while I think that there may be some reason I can't
>    kenh@cmf> imagine for people to want to turn it off, all of the
>    kenh@cmf> ones I'm aware of are inadvertent because they turned
>    kenh@cmf> off allow_svr on user principals).  And as I read
>    kenh@cmf> things, allow_svr is off by default.
>
>I'm thinking of cases where the principal is partially or fully
>disabled.

By "fully" disabled, you mean they set DISALLOW_ALL_TIX, right?  As
I read the patch, that wouldn't affect that; if you set it, it would
still disallow U2U for that principal.  And I guess I don't know
what partially disabled is, exactly.

--Ken