Thanks for spotting that, however fixing it made no difference.
Our current workaround is to put a sun webserver 'infront' of glassfish, and forward authenticated requests from the webserver to the appserver.
Ben
[Message sent by forum member 'benk' (benk)]
http://forums.java.net/jive/thread.jspa?messageID=266380