Security/authentication requirements for 1.3

["Chris Travers" <..hidden..>]

Hi all;

Since we decided to go with HTTP authentication for 1.3, we have run
into situations where existing functionality in session timeout cannot
be safely maintained.  I guess I would suggest the following couses of
action for 1.3:

1)  Offer a basic HTTP Auth module which has the following behavior
when a session times out:
   a)  Display a warning that discretionary locks have been released and
   b)  Create a new session.

2)  Offer a cookie-based auth system which requires re-authentication
when the session expires.

Any objection to this direction?

Best Wishes,
Chris Travers