OK, I've figured out what was going on. I'm a bit stuck for a solution, though.
The deal is this: Neither AOLserver nor OpenACS sends Expires or Cache-Control headers. And the URLs in OpenACS look like they should contain static documents.
Unfortunately, this means that my ISP's mandatory and invisible caching proxy caches them. Even more unfortunately, I share a proxy cache with the graphic designer and the client with whom I'm working.
So we've had a fun time the last few weeks, with everyone discovering that they're logged in as someone else.
The real solution would be for OpenACS to put out "Expires" headers at the top of each page, or to set Cache-Control to private.
I'm going to mess with the templating system a bit in the next few minutes, so that we won't have such ridiculous caching problems. (And if it helps, I'll submit a patch.) But if anyone has any obvious suggestions regarding where I can put this in, or reasons why this is a bad idea, I'll be happy to listen...
