On 3/17/15, 7:51 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote: > >Telling it to ignore the address doesn't actually change the requirement >that it be there. It just doesn't use it for enforcement. (Unless of course getRemoteUser() is still returning *something* to the servlet layer, in which case this is a bug.) -- Scott