Richard,
One very confusing aspect of this parameter (which I'm, btw, planning of fixing in the upcoming external authentication work) is that it exists both in acs-kernel and acs-subsite, and I forget which one is actually used.
Try setting them both.
/Lars
