Reply to thread

There are a couple issues at play:

• css.php deliberately run in the context that it is always guest access, thus allowing aggressive caching to be shared for all users
• The "user selectable" flag on a style is not actually a "disabled" flag.
• css.php arguments are not fully signed to prevent tampering.
  • There hash passed in is about the template list, and doesn't include the style & language ids.