Ema always makes the small niceties nicer. I thought that's common knowledge.

Thanks! Lets try this. Send topic used to have quite an outdated feel attached to it IMHO, ajaxifying it brings it more as it should behave. On a side note, I'm glad we have more action api used actively, it'll help to review its uses and needs. I'm not entirely convinced of the tweaks we needed lately to Security.php, but I may need some time (and implemented use-cases) to think it over.

Yups, I consider the changes to security a sort of "short-term" adjustments, just to get the idea of what we really need/want.

For example a possibility could be to just change fatal_error to know about the API and return an appropriate XML error when it's needed instead of a webpage.

I think that's appropriate, and probably (unless I'm missing some issue) the way to handle this. IIRC Request object knows if it's xml, fatal_error() can inquire it. (I was just about to say Response class, but it seems it's not its time yet...)