The framework has nothing to do with not authorizing requests properly. Diaspora had many problems when they first released because apparently they were all inexperienced programmers, like the guy who wrote that in Citi.