They're identifying the ACS by index on their end, routing the response back to the same place it was headed for the original application. Beyond that there are far too many variables involved around what you're trying to do to draw any other conclusions, but one presumes it's crossing vhosts and that's not possible. -- Scott