Hi Al,
another option is, to bring the acl control to the page.
It defines who can access this page in what manner. You also can use roles.
It's a little bit similar to the old Form Security options.
When the user doesn't match, the defined loginpage (webconf) comes up.
<xp:this.acl>
<xp:acl>
<xp:this.entries>
<xp:aclEntry fullName="[Operator]" name="[Operator]"
right="EDITOR" type="ROLE">
</xp:aclEntry>
</xp:this.entries>
</xp:acl>
</xp:this.acl>
Cheers
Uwe