[OpenID] Yahoo hijacking?

[SitG Admin]

>And where should we send the user? The openid.return_to value is not
>necessarily the referrer,

Quick question - what if the user is blocking the referer? Using a 
privacy/anonymizing plugin, etcetera? At that point the 
openid.return_to value is practically *guaranteed* not to match the 
referer. Is the user losing any security by blocking the referer?

-Shade