Thanks for the responses. There was another handler (at the server level and outside this particular virtual server) that was being picked up. Rhandom has some good suggestions. I was returning FORBIDDEN just because the concept is similar to some demo code I've seen where you return FORBIDDEN and a customized error page to display a login page.

-derby