Okay, I *think* it's fixed. In CVS, installed on test and en wikis.
I added a call to $this->loadDefaults(); if the password check fails in
User::loadFromSession(). As it was, it was clearing the user ID to
zero, but not anything else -- so user name, newtalk status, etc was
still set as for the user.
-- brion vibber (brion @
pobox.com)