Attacker can frontrun a users withdraw() or withdrawWithSig() function full balance withdrawals with small withdrawFor() calls to grief users. For example, if user A tries to withdraw 100 tokens using function withdraw() or withdrawWithSig(), the attacker can frontrun and withdraw a 1 wei amount using function withdrawFor(). This would cause As call to revert since now only 100 - 1 wei amount of tokens are withdrawable. 
Another issue that arises is that the withdrawFor() function defaults the destination to the from address. This is an issue since if the from address cannot deal with withdrawing msg.value (which is unlikely though) or if the user wanted to withdraw to another address, the tokens could be stuck in the from address contract or just simply sent to the from address EOA that was not supposed to receive the tokens. Due to this, an attacker is able to force a withdrawal to the from address. 
Introduce an allowance system for function withdrawFor(). 
