As I have seen, the bugs and master machines have the user/pass DB, plus Wez's blog allows us to log in with our CVS users, so I guess he also has a copy of the password file. I cannot estimate the security conserns of giving out the password file for our server, we will discuss this with systems@ (also CC-ed). We would need the token for http://master.php.net/fetch/cvspasswd.php
It's simple to implement a http post to either the pear website, bugs.php.net,
or master.php.net sites to check if you post the login details if you get
sent a cookie back.
Well, than that should be stored in the user's session and trusted onward, while he is on the site (and has the same cookie).
Goba