1: Use meta refresh have it hit your cgi every x seconds. 2:Keep a session db, if the browser has not hit the CGI in a timeout period, log out and force relogin on next hit.

-Waswas

oops misread the nor in nor refreshes against the server ignore this.