Someone mailed me off list and pointed out that the url I posted had been wrapped. I also noticed that I had given a url I had bookmarked which is a mirror of the document, not the official site. There is some other related material there and postscript and html versions in addition to the pdf. You can find it at: http://cookies.lcs.mit.edu/ Sorry for posting twice, but I think this is worth reading if you are doing user authentication, and it's pretty entertaining as well. Tagore Smith