but I don't see document.write as having a fundamental security
  flaw in this setup.