Just as a datapoint - we had a lot of internal debate within Yahoo about enabling this x-has-session API to let an RP determine if the user currently signed into Yahoo or not, and we've decided against it for the time being due to the privacy concerns raised by several people on this list. Allen