It looks great but...
I have installed roundcube at one site. Then I have started to experiment as I always do. And I discovered:
1. You can log in using
username@domain.com or username+domain.com, and you will find same inbox, with same messages, but NOT with same identities.
2. You can log in with
username@NOTYOURdomain.com. Is this related to: $rcmail_config['auto_create_user'] = TRUE/FALSE ?
3. I even managed (by a mistake, I left a tab open in Firefox, and login screens are all the same)
to log in some others RC installations, on completely different server. Then I tried once more, and it was confirmed, when I log in, their RC clients made new accounts, and wrote those new accounts to RC database.
