In the current implementation, it seems that an agent will accept requests from anybody, though it will only send responses to the master url in its configuration file.
I'd like that to change so that an agent will only act on requests from its master, but just comparing the urls doesn't seem good enough. How can the agent be sure that the server making the request really is who it says it is? -- Wendy
