That's because you're not checking for anything in the session. Use $session->param like you would for the CGI object.

For example:

$session->param( -name => "can_access", -value => 1 );

#sometime later, likely in a different request...


if($session->param("can_access")) {
#show secret page
} else {
#not allowed to see secret page
}
[download]

~Thomas~ 

"Excuse me for butting in, but I'm interrupt-driven..."