$PHP_AUTH_USER problem

hi, I have a problem about getting rid of this $PHP_AUTH_USER/PW envvar. The situation is, i must use the pop up autheticate box rather than using a form to do the login. here is the problem, suppose I login correctly then logout, then when i press the login icon to login again, the authetication box pop up again(cause I set up some cookie to control this when logout). everything fine except if the user press "cancel" button of the authetication box. obviously the HTTP/1.0 401 unauthorized message appear, but it the user than press the "Refresh" button of the browser, the web page is loaded. I understand the it is becasue the browser will sent the $PHP_AUTH_USER/PW append after the URL (just not shown at all) after once successful authetication. And I know by sending the HTTP/1.0 401 No cigar header can tell the browser the no to automatically append that. Unfortunately it FAIL. So, can the master grade user give me some hints, like where and when should the HTTP/1.0 401 No cigar be put. THX!!! Ivan