Mike Cowlishaw writes: > Good to see it works. Question: why is the 'opaque' field part of > the WWW-Authenticate: header? It would seem to be generally useful, > independent of authentication, and therefore perhaps merits a header > of its own: > > Opaque: 34e1....3c81 I wondered that myself. It would dovetail nicely with either the 'Session-ID' or 'Cookie' proposals. -Bill P.