Is there a reason we don't support the use of TKT_FLG_TRANSIT_POLICY_CHECKED to bypass client-side transited policy checking? (Or do we and I haven't looked closely enough?) -- Luke -- www.padl.com | www.fghr.net