> I notice that the security considerations here violate the requirement > in RFC 3920 to reply to IQs of type get or set. We need to figure that > out. Let the server reply to IQs on behalf of the client, as it would when it were offline? cheers, Remko