Who does source address validation? (was Re: what's that smell?)