My previous message didn't link to the official security response: here it is.  MeanwhileRob posted some more detailss about Vista SR and a "security feature".