Well, the cookie IS written into the cookie collection via that special case in ExpandScript, it's just never written out. I added a call in the WCS file to explicitly set the content type, but then it gets written into the response stream twice (you end up seeing the actual header at the bottom of the page). If I move it into the process subclass, it works OK (the cookie is written out and authentication works as expected) but seems really weird:
Response.ExpandScript("test2.wcs")
Response.ContentTypeHeader("text/html")
Hmmm... I have to look into that - I can't recall why the code does that. I think the idea was that ExpandScript should handle its own content type and headers and it gets its own response object.
However, as for the auth cookie that's special cased in ExpandScript, so no matter what it should pick up the cookie and use it a little further down (the cAuthSessionCookie logic).
+++ Rick ---