I just double checked my installation, and it is definitely *not* doing that. I then checked the code... and it should *definitely* not be doing that, if your session management is working right -- I don't think that it should authenticate against the cookie unless the session does not already exist (which is the ($gotsession == false or {blahblahblah}) parameter surrounding where this is placed). Are you sure that you put it in exactly the right spot, and you didn't by chance put it below the two closing curly brackets (})?
|