Clean up some XXX comments.

src/or/circuitbuild.c

@@ -1434,10 +1434,6 @@ pathbias_check_close(origin_circuit_t *ocirc, int reason)
     if (circ->timestamp_dirty) {
       /* Any circuit where there were attempted streams but no successful
        * streams could be bias */
-      // XXX: May open up attacks if the adversary can force connections
-      // on unresponsive hosts to use new circs. Vidalia displayes a "Retrying"
-      // state.. Can we use that? Does optimistic data change this?
-
       log_info(LD_CIRC,
             "Circuit %d closed without successful use for reason %d. "
             "Circuit purpose %d currently %s.",

src/or/circuituse.c

@@ -1166,6 +1166,7 @@ circuit_has_opened(origin_circuit_t *circ)
    * building). */
   // XXX: Cannibalized now use RELAY_EARLY, which is visible
   // to taggers end-to-end! We really need to probe these instead.
+  // Don't forget to remove this check once that's done!
   if (circ->has_opened &&
       circ->build_state->desired_path_len > DEFAULT_ROUTE_LEN) {
     circ->path_state = PATH_STATE_USE_SUCCEEDED;

src/or/relay.c

@@ -698,6 +698,8 @@ connection_ap_process_end_not_open(
      * it wasn't due to tagging */
     // XXX: This relies on recognized+digest being strong enough not
     // to be spoofable.. Is that a valid assumption? 
+    // Or more accurately: is it better than nothing? Can the attack
+    // be done offline?
     circ->path_state = PATH_STATE_USE_SUCCEEDED;
   }