One thing I should have said just to draw this conversation back on
topic...there's not much that Quixote can or should do to actually
*implement* the sort of atomic form token operation I need, since it knows
nothing about the persistent storage used for those tokens.  The one thing
that might be worth doing is providing an interface that implements the
"atomic test and clear" operation.  That could be as simple as having the
remove_form_token session method return a value saying whether it *really*
removed a token or not.

jon

Jonathan Corbet
Executive editor, LWN.net
corbet@lwn.net