I am to blame:
http://cvs.openacs.org/cvs/openacs-4/packages/acs-tcl/tcl/security-procs.tcl?r1=1.57&r2=1.58
Don fixed.
I neglected to initialize a variable in the appropriate context for all cases.
Happy New Year!
Torben