* David Binger wrote [2005-10-29 16:36:36 -0400]:

> Right.  Shall we change that condition to (session and not
> session.is_valid())?  I guess the is_valid() can enforce an https scheme if
> that is desired.

That sounds good...