By the way, while we are on this topic--can you confirm that passwords are not stored in plain-text?

Sure. You can see for yourself in the source: http://ycombinator.com/arc/arc1.tar

On disk at least. They're temporarily logged to memory in the clear:

  (def good-login (user pw ip)
    (let record (list (seconds) ip user pw)
      (if (and user pw (aand (shash pw) (is it (hpasswords* user))))
          (do (unless (user->cookie* user) (cook-user user))
              (enq-limit record good-logins*)
              user)
          (do (enq-limit record bad-logins*)
              nil))))

It might be good to pull the pw out of the record list:

  ...
   (let record (list (seconds) ip user)
     ...

Ok, I took it out. Turns out nothing later ever needs the pw anyway.

I hope you are not reusing an important password for this site.. Even if they are hashed on the disk, they are sent insecurely to the server when you log in.