still tweaking.

This one's a reminder -- we're considering pulling the firewalling bits out of the hosting chapter, expanding them, and putting them into a discussion of dom0 firewalling in the networking chapter.  The idea is that there are substantiative differences between firewalling in the Xen case and in the ordinary case -- with Xen, we want to firewall the dom0 but let the domUs have unfiltered access to the network.

Discussion of shaping will most likely still go in hosting.