Rotate the ratdesk service DSN this weekend. Old creds still in config.bak.
Comments are stored and rendered unencoded. And the id is a direct object reference with no ownership check - read ticket #102.