as a starter, i wrote permissions/allow_uri() function, which can be used to implement allow_refer_to as follows: allow_uri("basename", "$rt"); is it ok that i commit this new function and remove allow_refer_to function? -- juha