most significant change:
>make sure # of response matches # of queries, fixes int overflow; from ISS
as we have already enabled privsep by default, we should have been safe.
- ssh is no longer seruid root. ssh-keyscan is added to read secret host keys.
protocol version 1 rsh-like authentication is gone.
- FallBackToRsh is deprecated.