AUTH: multiple directories in site each with it's own login -> cross-directory authentication is happening

I have a site with multiple directories. Each directory is meant for a different "role". When you log in to one directory you should not be able to access another directory. I have a session variable identifying the user's "role". In each directory, every page EXCEPT the login has code which checks the session variable and redirects or accepts the user based on sesison qualifications. The problem is the login page. You obviously can not restrict access to the login page because users would have no way of loggin in. I did however, add the following to the top of the login page: if(isset($_SESSION['qualification'])) { unset($_SESSION['qualification']); header("Location: go_somewhere_else.php"); exit(); } What this SHOULD do is check if the user has qualification session variable form another directory and redirect that user. What is happening, based on a session dump, when the user whose session variable contains a quatification from another directory comes to to this directory, where they should not be, the user: is stammped with the sesison variable qualifying him as a user in THIS directory then logs him out. My code above is at the top of the script so it should not even get to the point where the user is run through AUTH again. What's up with this? __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com