Should be fixed now. As a bonus, I've removed all the uses of HTTP_POST_VARS from all scripts. All forms should use the new data_submitted() function to collect form data (it does the match_referer thing internally now). Much nicer.
Minor little interface cleanups along the way