The ignoreRequestSignatures profile option allows the spec to be violated in that fashion. Overrides are never needed at ths point, metadata-driven tags are the advisable way to set most simple profile options, provided one is careful to strip incoming tags from third party sources. -- Scott