I don't think it's just the redirect ... it seems that what he wants is something that will authorize the client in a non-standard manner. Personally, I'd think you need a pretty fancy solution for that (e.g. a mod_perl enabled server with a custom authentication handler; you'd set a cookie at some point, and the handler would read the cookie and if not present, restrict access).

But there are many bright people here, I suppose they can come up with something less drastic.

Philosophy can be made out of anything. Or less -- Jerry A. Fodor

I think the issue is how the whole redirection trick works. If the browser does all the work, and the protocol allows you to pass the necessary authorization fields, it could happen. (Unfortunately, I don't know the answers to those questions).

I've dug around in the CGI.pm code, and the redirect() function will pass additional arguments along, so that will work. It's just a matter of finding out IF such arguments exist, and if so, what they are.