diff --git a/checkin_notes b/checkin_notes
index 57f6a6d6ff..556aa79f99 100644
--- a/checkin_notes
+++ b/checkin_notes
@@ -1302,3 +1302,14 @@ David  Feb 9 2008
         app_control.C
     sched/
         sched_hr.C
+
+David  Feb 12 2008
+    - client: removed sprawl
+
+    client/
+        app_start.C
+        client_state.C,h
+        file_names.h
+        sandbox.C
+    lib/
+        util.C,h
diff --git a/client/app_start.C b/client/app_start.C
index 92d4d07ad1..e48c2e6811 100644
--- a/client/app_start.C
+++ b/client/app_start.C
@@ -328,10 +328,6 @@ int ACTIVE_TASK::start(bool first_time) {
     FILE_REF fref;
     FILE_INFO* fip;
     int retval;
-#ifdef _WIN32
-    CLIENT_AUTHORIZATION ca;
-    std::string cmd_line;
-#endif
 
     if (first_time && log_flags.task) {
         msg_printf(result->project, MSG_INFO,
@@ -465,6 +461,7 @@ int ACTIVE_TASK::start(bool first_time) {
     STARTUPINFO startup_info;
     char slotdirpath[256];
     char error_msg[1024];
+    std::string cmd_line;
 
     memset(&process_info, 0, sizeof(process_info));
     memset(&startup_info, 0, sizeof(startup_info));
@@ -498,16 +495,15 @@ int ACTIVE_TASK::start(bool first_time) {
     cmd_line = exec_path + std::string(" ") + wup->command_line;
     relative_to_absolute(slot_dir, slotdirpath);
     bool success = false;
-    ca.init();
     for (i=0; i<5; i++) {
-        if (ca.use_authorizations) {
+        if (strlen(gstate.sandbox_user_account_name) {
             HANDLE hToken;
-            std::string username = ca.boinc_project.username;
-            std::string password = r_base64_decode(ca.boinc_project.password);
+            std::string username = gstate.sandbox_user_account_name;
+            std::string password = r_base64_decode(gstate.sandbox_user_account_password);
             if (!LogonUser( username.c_str(), NULL, password.c_str(), 
-                            LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT,
-                            &hToken ) )
-            {
+                LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT,
+                &hToken)
+            ) {
                 windows_error_string(error_msg, sizeof(error_msg));
                 msg_printf(wup->project, MSG_INTERNAL_ERROR,
                     "LogonUser failed: %s", error_msg
diff --git a/client/client_state.C b/client/client_state.C
index 22a73f282f..06b6e84404 100644
--- a/client/client_state.C
+++ b/client/client_state.C
@@ -118,6 +118,10 @@ CLIENT_STATE::CLIENT_STATE():
     new_version_check_time = 0;
     all_projects_list_check_time = 0;
     detach_console = false;
+#ifdef _WIN32
+    strcpy(sandbox_account_name, "");
+    strcpy(sandbox_account_password, "");
+#endif
 #ifdef SANDBOX
     g_use_sandbox = true; // User can override with -insecure command-line arg
 #endif
@@ -207,6 +211,7 @@ int CLIENT_STATE::init() {
             "BOINC is running as a service and as a non-system user."
         );
     }
+    read_client_auth_file();
 #endif
 
 #ifdef __APPLE__
diff --git a/client/client_state.h b/client/client_state.h
index b8efff383b..7844c8967d 100644
--- a/client/client_state.h
+++ b/client/client_state.h
@@ -111,7 +111,11 @@ public:
     char attach_project_auth[256];
     bool exit_before_upload;
         // exit when about to upload a file
-#ifndef _WIN32
+#ifdef _WIN32
+    char sandbox_account_name[256];
+    char sandbox_account_password[256];
+    void read_client_auth_file();
+#else
     gid_t boinc_project_gid;
 #endif
 
diff --git a/client/file_names.h b/client/file_names.h
index ed749897d0..156f4a4494 100644
--- a/client/file_names.h
+++ b/client/file_names.h
@@ -88,5 +88,6 @@ extern void send_log_after(const char* filename, double t, MIOFILE& mf);
 #define TIME_STATS_LOG              "time_stats_log"
 #define JOB_LOG_BASE                "job_log_"
 #define CA_BUNDLE_FILENAME          "ca-bundle.crt"
+#define CLIENT_AUTH_FILENAME        "client_auth.xml"
 
 #endif
diff --git a/client/sandbox.C b/client/sandbox.C
index b410df24bf..0404bd14cb 100644
--- a/client/sandbox.C
+++ b/client/sandbox.C
@@ -36,7 +36,21 @@
 
 bool g_use_sandbox = false;
 
-#ifndef _WIN32
+#ifdef _WIN32
+
+int CLIENT_STATE::read_client_auth_file() {
+    FILE* f;
+
+    f = fopen(CLIENT_AUTH_FILENAME, "r");
+    if (!r) return;
+    while (fgets(buf, 256, f)) {
+        if (parse_str(buf, "<username>", sandbox_account_name)) continue;
+        if (parse_str(buf, "<username>", sandbox_account_password)) continue;
+    }
+    fclose(f);
+}
+
+#else
 #ifndef _DEBUG
 static int lookup_group(char* name, gid_t& gid) {
     struct group* gp = getgrnam(name);
diff --git a/html/inc/bossa_db.inc b/html/inc/bossa_db.inc
index 5884d92710..207dc2c12e 100644
--- a/html/inc/bossa_db.inc
+++ b/html/inc/bossa_db.inc
@@ -65,7 +65,7 @@ class BossaJob {
     }
     function update($clause) {
         $db = BossaDb::get();
-        return $db->update('bossa_job', $clause);
+        return $db->update($this, 'bossa_job', $clause);
     }
     static function lookup_id($id) {
         $db = BossaDb::get();
@@ -140,10 +140,8 @@ class BossaJobInst {
         $this->finish_time = time();
         $this->update("finish_time=$this->finish_time, info='$this->info'");
 
-        $job->npending--;
-        $job->nsuccess++;
-        $job->more_needed = ($job->npending+$job->nsuccess < $job->nsuccess_needed);
-        return $job->update("npending=$job->npending, nsuccess=$job->nsuccess, more_needed=$job->more_needed");
+        $now = time();
+        return $job->update("transition_time=$now");
     }
 
     // The given job instance has timed out.
diff --git a/html/user/bossa_example.php b/html/user/bossa_example.php
index 52a11b2a0a..c8b3463621 100644
--- a/html/user/bossa_example.php
+++ b/html/user/bossa_example.php
@@ -28,9 +28,8 @@ function handle_job_completion($bj, $bji) {
         $response->have_ellipse = 0;
     } else {
         $response->have_ellipse = 1;
-        $pic = $_GET['pic'];
-        $response->cx = $pic.x;
-        $response->cy = $pic.y;
+        $response->cx = get_int('pic_x');
+        $response->cy = get_int('pic_y');
     }
     $bji->info = json_encode($response);
     $bji->completed($bj);
diff --git a/lib/util.C b/lib/util.C
index ac05febb2b..5d0a5a2311 100644
--- a/lib/util.C
+++ b/lib/util.C
@@ -286,62 +286,12 @@ void update_average(
 //
 #ifdef _WIN32
 
-void BOINC_PROJECT_ACCOUNT::clear() {
-    username.clear();
-    password.clear();
-}
-
-int BOINC_PROJECT_ACCOUNT::parse(MIOFILE& in) {
-    char buf[256];
-    while (in.fgets(buf, 256)) {
-        if (match_tag(buf, "</boinc_project>")) return 0;
-        if (parse_str(buf, "<username>", username)) continue;
-        if (parse_str(buf, "<password>", password)) continue;
-    }
-    return ERR_XML_PARSE;
-}
-
-
-void CLIENT_AUTHORIZATION::clear() {
-    use_authorizations = false;
-    boinc_project.clear();
-}
-
-int CLIENT_AUTHORIZATION::parse(MIOFILE& in) {
-    char buf[256];
-    use_authorizations = true;
-
-    while (in.fgets(buf, 256)) {
-        if (match_tag(buf, "</client_authorization>")) return 0;
-        if (match_tag(buf, "<boinc_project>")) {
-            boinc_project.parse(in);
-            continue;
-        }
-    }
-    return ERR_XML_PARSE;
-}
-
-int CLIENT_AUTHORIZATION::init() {
-    MIOFILE mf;
-    FILE*   p;
-
-    clear();
-    p = fopen("client_auth.xml", "r");
-    if (p) {
-        mf.init_file(p);
-        parse(mf);
-        fclose(p);
-    }
-    return 0;
-}
-
 int run_program(
-    const char* dir, const char* file, int argc, char *const argv[], double nsecs, HANDLE& id
+    const char* dir, const char* file, int argc, char *const argv[], double nsecs
 ) {
     int retval;
     PROCESS_INFORMATION process_info;
     STARTUPINFO startup_info;
-    CLIENT_AUTHORIZATION ca;
     char cmdline[1024];
     unsigned long status;
 
@@ -357,55 +307,19 @@ int run_program(
         }
     }
 
-    ca.init();
-    if (ca.use_authorizations) {
-        HANDLE hToken;
-        std::string username = ca.boinc_project.username;
-        std::string password = r_base64_decode(ca.boinc_project.password);
-        retval = LogonUser(
-            username.c_str(),
-            NULL,
-            password.c_str(),
-            LOGON32_LOGON_SERVICE,
-            LOGON32_PROVIDER_DEFAULT,
-            &hToken
-        );
-        if (!retval) {
-            return -1; // LogonUser returns 1 if successful, false if it failed.
-        }
+    retval = CreateProcess(
+        file,
+        cmdline,
+        NULL,
+        NULL,
+        FALSE,
+        0,
+        NULL,
+        dir,
+        &startup_info,
+        &process_info
+    );
 
-        retval = CreateProcessAsUser(
-            hToken,
-            file,
-            cmdline,
-            NULL,
-            NULL,
-            FALSE,
-            0,
-            NULL,
-            dir,
-            &startup_info,
-            &process_info
-        );
-
-        CloseHandle(hToken);
-
-    } else {
-
-        retval = CreateProcess(
-            file,
-            cmdline,
-            NULL,
-            NULL,
-            FALSE,
-            0,
-            NULL,
-            dir,
-            &startup_info,
-            &process_info
-        );
-
-    }
     if (!retval) {
         return -1; // CreateProcess returns 1 if successful, false if it failed.
     }
diff --git a/lib/util.h b/lib/util.h
index 3f8f098113..ad247aa6d9 100644
--- a/lib/util.h
+++ b/lib/util.h
@@ -71,42 +71,9 @@ extern int boinc_calling_thread_cpu_time(double&);
 //
 extern void mysql_timestamp(double, char*);
 
-// C++ API follows 
-#ifdef __cplusplus
-
-class MIOFILE;
-
-class BOINC_PROJECT_ACCOUNT {
-public:
-    std::string username;
-    std::string password;
-
-    BOINC_PROJECT_ACCOUNT() { clear(); }
-    ~BOINC_PROJECT_ACCOUNT() { clear(); }
-
-    int parse(MIOFILE&);
-    void clear();
-};
-
-class CLIENT_AUTHORIZATION {
-public:
-    bool use_authorizations;
-    BOINC_PROJECT_ACCOUNT boinc_project;
-
-    CLIENT_AUTHORIZATION() { clear(); }
-    ~CLIENT_AUTHORIZATION() { clear(); }
-
-    int parse(MIOFILE&);
-    int init();
-    void clear();
-};
-
-#endif // C++ part
-
-
 #ifdef _WIN32
 extern int run_program(
-    const char* path, const char* cdir, int argc, char *const argv[], double, HANDLE&
+    const char* path, const char* cdir, int argc, char *const argv[], double
 );
 extern void kill_program(HANDLE);
 extern int get_exit_status(HANDLE);