Accessing an unprotected area triggers our custom AuthenticationMechanism. Is this by design or by spec mandate? Or a bug? -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com