I think Scott's using BASIC Authentication for handling logins and there's no capacity in the spec to turn that off. Once that browser has been authenticated to the server, it always sends the authentication information.

Only way I could think of to do it would be to tie the authentication code to a session id and when the user 'logs off' you just invalidate the session id. That level of control may not be available with Zope

hmmm...that may not work. I was playing with something similar a few weeks back and I remember running into problems with Apache eating some browser headers and I think it was the client authentication string once the browser had been authenticated by the server

ok...just meandering now...am I making any sense?