thanks.

i did set up the logout as the Location like LOGIN, but it wouldn't do what i wanted. i've googled for days, and it looke like most people work around the issue ( like i did ) by hand-rolling a logout.cgi that just expires the cookies. it works, so TMTOWTDI

i also changed the directives around after reading through the Horsey book again. i don't have it in front of me, but it was something like:

<Location />
  <FilesMatch "\.(pl|cgi)>
  Options +ExecCGI
  .... other stuff ...
  </FilesMatch>
</Location>
[download]

and that fixes the issue nicely.