Way to prevent infinite redirect loop caused by "SWD_service_redirect" should be written here. (Provide a limitation to redirect count?)
Mike will investigate
I've sent a note about this to the WebFinger list. I think it should be added to the security considerations there.
Mike raised the issue on the WebFinger list. It will be up to that WG whether to add text to the WebFinger spec.