/me thinks there should also be a check in sendprivate if there isn't already -- keeps the in-the-know peeps from just directly entering a URL