fre 2009-08-07 klockan 11:18 -0800 skrev Chris Robertson: > ...which indicates to me that if the external_acl_type returns the > keywords "user" and/or "password", those will be substituted for the > "real" credentials supplied by the client. I have to assume the > original poster interpreted this documentation in the same manner. Those are meant to be used when there is no credentials in the request, not as a substitute. Regards Henrik