Oh and as far as the rest of bbPress security, the bbPress password/cookie method has never been more secure than the method used in 1.0 (and WP 2.6) It’s based on a security researcher’s design (first implimented incorrectly in WP 2.5 and bbPress 0.9)
