IE cookies don't expire!

Hello all, I am writing an app using PHP that sets two cookies - a username and password cookie to control a user's session. These cookies are set every time a page is loaded and expire after a period of time (half an hour at the moment). Some pages that are displayed contain sensitive information so these pages have REFRESH tags set so that the page expires 10 seconds after the cookie expires. Well, the whole thing works swimmingly on Netscape and Moz but doesn't work under IE. I'm talking about v5 and upwards. The cookies get set just fine and the whole app works swimmingly but when the page expires, IE simply reloads it! I watch IE and I see the refresh taking place and the page's content gets reloaded instead of the login prompt. I've checked the cookie dates and they are set to the correct time and in GMT. The PC is also set to the correct time. I've tried using setcookie() and header() to set the cookies but it seems to make no difference. Does IE handle cookie expiry differently? Am I missing something? I've enclosed my login code for your reference. FYI, all the data is stored in a MySQL database. I connect to the database and fetch the user's details from a table in it. Then I match the username and the crypted passwd against the cookie. If it works, then the cookies are set and I also fudge setting the variables so I don't have to force a refresh of the page.

       $login = $HTTP_POST_VARS["login"];

       // Set up some cookie variables
       // GMT date for the expiry
       $date = gmdate("l, d-M-Y H:i:s", (time() + $cookie_lifetime));
       $curr_time = gmdate("l, d-M-Y H:i:s", time());
       // Secure tag if it's a secure cookie
       if ( $cookie_secure )
       {
               $secure_tag = "secure";
       } else {
               $secure_tag = "";
       }

       debugMessage("login: " . $login, 1);
       if ( ! $login )
       {
               // No login button.  This means we're logging in for the first time or
               // are already logged in.  Either way, we determine this using the cookies
               $username = $HTTP_COOKIE_VARS[$username_cookie];
               $password = $HTTP_COOKIE_VARS[$password_cookie];
               $cookie_set = "login: $login username: $username";
               debugMessage("Cookies: username: " . $username . " password: " . $password, 1);
               if ( validateLogin($username, $password) )
               {
                       // Re-set the cookie.  By doing this we're re-setting the expiry.
                       header("Set-Cookie: ${username_cookie}=$username; expires=$date GMT; path=$cookie_path; domain=$cookie_host; $secure_tag");
                       header("Set-Cookie: ${password_cookie}=$password; expires=$date GMT; path=$cookie_path; domain=$cookie_host; $secure_tag");
                       // setcookie($username_cookie, $username, time() + $cookie_lifetime, $cookie_path, $cookie_host, $cookie_secure);
                       // setcookie($password_cookie, $password, time() + $cookie_lifetime, $cookie_path, $cookie_host, $cookie_secure);
                       $HTTP_COOKIE_VARS[$username_cookie] = $username;
                       $HTTP_COOKIE_VARS[$password_cookie] = $password;
               } else {
                       displayLoginPage();
               }
       } else {
               // If we have pressed the login button, then the username and password
               // are in the POST_VARS.  We extract them and encrypt the password before validating.
               $username = $HTTP_POST_VARS["username"];
               $password = $HTTP_POST_VARS["password"];
               // this is for debugging
               $cookie_set = "login: $login username: $username";
               $password = encryptPassword($password);
               debugMessage("username: " . $username . " password: " . $password, 1);
               if ( validatelogin($username, $password) )
               {
                       header("Set-Cookie: ${username_cookie}=$username; expires=$date GMT; path=$cookie_path; domain=$cookie_host; $secure_tag");
                       header("Set-Cookie: ${password_cookie}=$password; expires=$date GMT; path=$cookie_path; domain=$cookie_host; $secure_tag");
                       // setcookie($username_cookie, $username, time() + $cookie_lifetime, $cookie_path, $cookie_host, $cookie_secure);
                       // setcookie($password_cookie, $password, time() + $cookie_lifetime, $cookie_path, $cookie_host, $cookie_secure);
                       $HTTP_COOKIE_VARS[$username_cookie] = $username;
                       $HTTP_COOKIE_VARS[$password_cookie] = $password;
               } else {
                       ?>
                       <center><b>Login Incorrect</b></center><hr>
                       <?php
                       displayLoginPage();
               }
       }

-- Mark Ferraretto Phone: +61 8 8396 2448 Ferraretto IT Services Fax: +61 8 8396 7176 26 Observation Drive Mobile: +61 407 959 719 Highbury SA 5089 Email: mark@ferraretto.com Australia ICQ: 64748102