> When I hit /Session I see my attributes there but they are not show up in > http header. Why? Either you aren't protecting the resource you're looking for the headers on, or this is Apache and you don't have headers enabled and it's populating the environment variables only, which is preferred. -- Scott