Good to see it works. Question: why is the 'opaque' field part of the WWW-Authenticate: header? It would seem to be generally useful, independent of authentication, and therefore perhaps merits a header of its own: Opaque: 34e1....3c81 Mike Cowlishaw IBM UK Laboratories