diff --git swfupload.module swfupload.module
index 965c328..ab67293 100644
--- swfupload.module
+++ swfupload.module
@@ -35,34 +35,56 @@ function swfupload_upload_access() {
   $result = FALSE;
   $p = (object) $_POST;
 
-  // Validate the request
+  // Validate the request.
   if (!empty($p->sid)) {
-    $sid = split("\*", hex2bin($p->sid));
-    
-    // Use the core methods to restore the session
-    global $user;
-    $user = user_load($sid[0]);
-    // This is needed. Most people forget about this - thats why forms wont work anymore ... the validation fails (token)
-    session_id($user->sid);
-
-    if (!user_access('upload files with swfupload')) {
-      return false;
+    // $hash_arr[0] is the uid the user wants to athenticate for.
+    // $hash_arr[1] is the md5-hashed sid of drupals authetication token.
+    $hash_arr = split("\*", hex2bin($p->sid));
+    $uid = $hash_arr[0];
+    $token = $hash_arr[1];
+
+    if ($uid == 0) {
+      // If the uid is 0, there will be no session id.
+      // We'll check if the hash of the current remote address matches the sent one.
+      return ($token == md5($_SERVER['REMOTE_ADDR']));
     }
 
-    if (!$user->uid) {
-      return ($sid[1] == md5($_SERVER['REMOTE_ADDR']));
-    }
+    // Get all session for the provided user
+    $result = db_query("SELECT sid FROM {sessions} WHERE uid = %d", $uid);
+    // There is no user with that uid, deny permission.
+    if($result == false) {
+      return false;
+    } 
 
-    $result = db_query("SELECT sid FROM {sessions} WHERE uid = %d", $sid[0]);
+    $valid_sids = array();
+    // create our hashes we need for verification
     while ($row = db_fetch_object($result)) {
       $valid_sids[] = md5($row->sid);
     }
-
-    if (in_array($sid[1], $valid_sids)) {
-      return TRUE;
+    
+    // If the hashed session is is present in the stored hashed session ids from the database,
+    // and if there weren't more that 5 invalid attempts for matching,
+    // make the user account global so other modules can use its credentials.
+    if (in_array($token, $valid_sids) && flood_is_allowed('swfupload_restore_session', 5)) {
+      // Use the global user, as we are about to store the loaded account object in it.
+      global $user;
+
+      // Now load the global user object to "login". We use the $uid provided, as we verfified
+      // that the token is correct (and matches this user)
+      $user = user_load($uid);
+
+      // This is needed. Most people forget about this - thats why forms wont work anymore ... the validation fails (token).
+      session_id($user->sid);
+
+      // As the user session is restored, check for general rights to use swfupload
+      return user_access('upload files with swfupload');
+    }
+    else {
+      // Register unwanted attempts to rstore the session.
+      flood_register_event('swfupload_restore_session');
     }
 
-    // The sid doesn't exist for this user.
+    // The sid doesn't exist for this user or its a flood attack
     return FALSE;
   }
   // No session ID is set, we can assume we're still in the same session