lol, so my browser hadn't loaded Ivan's response to Jordan's initial comment yet. Two people are disagreeing, a third person interjects "I agree" without specifying whom :) I was agreeing with Jordan. Consulting the referrer is probably not ideal because it's spoofable. Looks like the db doesn't have the requisite info. JNDI sounds ok. I vote for that.