I don't think Fedora's OpenID login has this flaw. Would it be possibleto allow OpenID login for white-listed providers which are known to bewell-behaved?