diff --git a/relay/cref.h b/relay/cref.h
index ea7afcbc9..3fbf364af 100644
--- a/relay/cref.h
+++ b/relay/cref.h
@@ -45,19 +45,27 @@ class HostRec {
 
 class CookieRef {
 
- public:
+ private:
+    /* These classes have access to CookieRef.  All others should go through
+       SafeCref instances. */
+    friend class CRefMgr;
+    friend class SafeCref;
+    friend class CookieMapIterator;
 
+    CookieRef( string s, CookieID id );
     ~CookieRef();
 
     /* Within this cookie, remember that this hostID and socket go together.
        If the hostID is HOST_ID_SERVER, it's the server. */
-    short GetHeartbeat() { return m_heatbeat; }
     CookieID GetCookieID() { return m_connectionID; }
     int HostKnown( HostID host ) { return -1 != SocketForHost( host ); }
     int CountSockets() { return m_hostSockets.size(); }
     int HasSocket( int socket );
     string Name() { return m_name; }
 
+    short GetHeartbeat() { return m_heatbeat; }
+    int SocketForHost( HostID dest );
+
     int NotFullyConnected() { return m_curState != XW_ST_ALLCONNECTED; }
 
     /* for console */
@@ -70,7 +78,6 @@ class CookieRef {
     static void Delete( CookieID id );
     static void Delete( const char* name );
 
-    /* These need to become private */
     void _Connect( int socket, HostID srcID );
     void _Reconnect( int socket, HostID srcID );
     void _HandleHeartbeat( HostID id, int socket );
@@ -81,8 +88,6 @@ class CookieRef {
 
     int ShouldDie() { return m_curState == XW_ST_DEAD; }
 
- private:
-
     typedef struct CRefEvent {
         XW_RELAY_EVENT type;
         union {
@@ -122,11 +127,6 @@ class CookieRef {
         } u;
     } CRefEvent;
 
-    friend class CRefMgr;
-    CookieRef( string s, CookieID id );
-
-    int SocketForHost( HostID dest );
-
     void send_with_length( int socket, unsigned char* buf, int bufLen );
     void RecordSent( int nBytes, int socket ) {
         m_totalSent += nBytes;