One very confusing aspect of this parameter (which I'm, btw, planning of fixing in the upcoming external authentication work) is that it exists both in acs-kernel and acs-subsite, and I forget which one is actually used.

Try setting them both.

/Lars