diff --git a/cgi/logout.cgi b/cgi/logout.cgi
index b2a830c..41fa7e1 100755
--- a/cgi/logout.cgi
+++ b/cgi/logout.cgi
@@ -33,16 +33,19 @@ $back ||= $q->cookie($at->back_cookie_name) if $at->back_cookie_name;
 $back ||= $q->param($at->back_arg_name) if $at->back_arg_name;
 $back = $AuthTktConfig::DEFAULT_BACK_LOCATION if $AuthTktConfig::DEFAULT_BACK_LOCATION;
 $back ||= $ENV{HTTP_REFERER} if $ENV{HTTP_REFERER} && $AuthTktConfig::BACK_REFERER;
-if ($back && $back =~ m!^/!) {
-  my $hostname = $server_name;
-  my $port = $server_port;
-  $hostname .= ':' . $port if $port && $port != 80 && $port != 443;
-  $back = sprintf "http%s://%s%s", ($port == 443 ? 's' : ''), $hostname, $back;
-} elsif ($back && $back !~ m/^http/i) {
-  $back = 'http://' . $back;
+my $back_html = '';
+if ($back) {
+  if ($back =~ m!^/!) {
+    my $hostname = $server_name;
+    my $port = $server_port;
+    $hostname .= ':' . $port if $port && $port != 80 && $port != 443;
+    $back = sprintf "http%s://%s%s", ($port == 443 ? 's' : ''), $hostname, $back;
+  } elsif ($back !~ m/^http/i) {
+    $back = 'http://' . $back;
+  }
+  $back = uri_unescape($back) if $back =~ m/^https?%3A%2F%2F/;
+  $back_html = escapeHTML($back);
 }
-$back = uri_unescape($back) if $back =~ m/^https?%3A%2F%2F/;
-my $back_html = escapeHTML($back) if $back;
 
 # Logout by resetting the auth cookie
 my @cookies = cookie(-name => $at->cookie_name, -value => '', -expires => '-1h', 
diff --git a/conf/auth_tkt_cgi.conf b/conf/auth_tkt_cgi.conf
index e2546bc..e969c44 100644
--- a/conf/auth_tkt_cgi.conf
+++ b/conf/auth_tkt_cgi.conf
@@ -13,6 +13,9 @@
 # Digest type to use - default is MD5, alternatives are SHA256 or SHA512
 #TKTAuthDigestType MD5
 
+# Query separator for generated URLs. Defaults to semi-colon (';')
+#TKTAuthQuerySeparator &
+
 # Used by sample CGI scripts to locate this config file
 SetEnv MOD_AUTH_TKT_CONF "/etc/httpd/conf.d/auth_tkt_cgi.conf"
 
diff --git a/doc/mod_auth_tkt.pod b/doc/mod_auth_tkt.pod
index dd7d85c..edf0590 100644
--- a/doc/mod_auth_tkt.pod
+++ b/doc/mod_auth_tkt.pod
@@ -227,7 +227,9 @@ the ticket hashing, so you should always set a TKTAuthTimeout in
 addition to using an expiry. Cookie expiries are refreshed with
 tickets if TKTAuthTimeoutRefresh is set.
 
-Default: none. Examples:
+Default: none (not used).
+
+e.g.
 
   TKTAuthCookieExpires 86400
   TKTAuthCookieExpires 1w
@@ -245,6 +247,11 @@ http://www.example.com/index.html and TKTAuthBackArgName is set to
 
 to the TKTAuthLoginURL it redirects to, allowing your login script
 to redirect back to the requested page upon successful login.
+
+To omit altogether, set to the string B<None> i.e.
+
+  TKTAuthBackArgName None
+
 Default: 'back'.
 
 =item TKTAuthBackCookieName <name>
@@ -252,7 +259,9 @@ Default: 'back'.
 The cookie name to use for the back cookie. If this is set,
 mod_auth_tkt will set a back cookie containing a URI-escaped version
 of current requested page when redirecting (see TKTAuthBackArgName
-above). Default: none.
+above), instead of using a GET parameter.
+
+Default: none (not used).
 
 =item TKTAuthToken <token>
 
@@ -267,7 +276,9 @@ Note that this directive can be repeated, and the semantics are that
 B<any> of the required tokens is sufficient for access i.e. the tokens
 are ORed.
 
-Default: none. e.g.
+Default: none (not used).
+
+e.g.
 
   TKTAuthToken finance
   TKTAuthToken admin
@@ -281,8 +292,12 @@ this as well, setting the client IP address to 0.0.0.0). This is
 often required out on the open internet, especially if you are 
 using an HTTPS login page (as you should) and are dealing with 
 more than a handful of users (the typical problem being 
-transparent HTTP proxies at ISPs). Default: 'off' i.e. ticket
-is only valid from the originating IP address. e.g.
+transparent HTTP proxies at ISPs).
+
+Default: 'off' i.e. ticket is only valid from the originating
+IP address.
+
+e.g.
 
   TKTAuthIgnoreIP on
 
diff --git a/src/mod_auth_tkt.c b/src/mod_auth_tkt.c
index c2609e9..74bb669 100644
--- a/src/mod_auth_tkt.c
+++ b/src/mod_auth_tkt.c
@@ -38,6 +38,7 @@
 #define REMOTE_USER_TOKENS_ENV "REMOTE_USER_TOKENS"
 #define DEFAULT_TIMEOUT_SEC 7200
 #define DEFAULT_GUEST_USER "guest"
+#define QUERY_SEPARATOR ';'
 
 #define FORCE_REFRESH 1
 #define CHECK_REFRESH 0
@@ -68,6 +69,7 @@ typedef struct  {
   char *guest_user;
   int guest_fallback;
   int debug;
+  const char *query_separator;
 } auth_tkt_dir_conf;
 
 /* Per-server configuration */
@@ -99,24 +101,24 @@ void
 auth_tkt_version(server_rec *s, pool *p)
 {
   ap_add_version_component("mod_auth_tkt/" TKT_AUTH_VERSION);
-  ap_log_error(APLOG_MARK, APLOG_INFO, APR_SUCCESS, s, 
+  ap_log_error(APLOG_MARK, APLOG_INFO, APR_SUCCESS, s,
       "mod_auth_tkt: version %s", TKT_AUTH_VERSION);
 }
 
 #else
 static int
-auth_tkt_version(apr_pool_t *p, 
+auth_tkt_version(apr_pool_t *p,
   apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
 {
   ap_add_version_component(p, "mod_auth_tkt/" TKT_AUTH_VERSION);
-  ap_log_error(APLOG_MARK, APLOG_INFO, APR_SUCCESS, s, 
+  ap_log_error(APLOG_MARK, APLOG_INFO, APR_SUCCESS, s,
       "mod_auth_tkt: version %s", TKT_AUTH_VERSION);
   return DECLINED;
 }
 #endif
 
 /* Create per-dir config structures */
-static void * 
+static void *
 create_auth_tkt_config(apr_pool_t *p, char* path)
 {
   auth_tkt_dir_conf *conf = apr_palloc(p, sizeof(*conf));
@@ -142,11 +144,12 @@ create_auth_tkt_config(apr_pool_t *p, char* path)
   conf->guest_user = NULL;
   conf->guest_fallback = -1;
   conf->debug = -1;
-  return conf;  
+  conf->query_separator = (char *)QUERY_SEPARATOR;
+  return conf;
 }
 
 /* Merge per-dir config structures */
-static void * 
+static void *
 merge_auth_tkt_config(apr_pool_t *p, void* parent_dirv, void* subdirv)
 {
   auth_tkt_dir_conf *parent = (auth_tkt_dir_conf *) parent_dirv;
@@ -174,6 +177,7 @@ merge_auth_tkt_config(apr_pool_t *p, void* parent_dirv, void* subdirv)
   conf->guest_user = (subdir->guest_user) ? subdir->guest_user : parent->guest_user;
   conf->guest_fallback = (subdir->guest_fallback >= 0) ?  subdir->guest_fallback : parent->guest_fallback;
   conf->debug = (subdir->debug >= 0) ? subdir->debug : parent->debug;
+  conf->query_separator = (subdir->query_separator) ? subdir->query_separator : parent->query_separator;
 
   return conf;
 }
@@ -188,7 +192,7 @@ create_auth_tkt_serv_config(apr_pool_t *p, server_rec* s)
   sconf->digest_type = NULL;
   sconf->digest_sz = 0;
   return sconf;
-} 
+}
 
 /* Merge per-server config structures */
 static void *
@@ -203,7 +207,7 @@ merge_auth_tkt_serv_config(apr_pool_t *p, void* parent_dirv, void* subdirv)
   sconf->digest_type = (subdir->digest_type) ? subdir->digest_type : parent->digest_type;
   sconf->digest_sz   = (subdir->digest_sz) ? subdir->digest_sz : parent->digest_sz;
   return sconf;
-} 
+}
 
 /* ----------------------------------------------------------------------- */
 /* Command-specific functions */
@@ -243,8 +247,8 @@ convert_to_seconds (cmd_parms *cmd, const char *param, int *seconds)
       multiplier = 30 * 24 * 60 * 60;
     else if (unit == 'y')
       multiplier = 365 * 24 * 60 * 60;
-    else 
-      return apr_psprintf(cmd->pool, 
+    else
+      return apr_psprintf(cmd->pool,
         "Bad time string - unrecognised unit '%c'", unit);
   }
 
@@ -256,7 +260,7 @@ convert_to_seconds (cmd_parms *cmd, const char *param, int *seconds)
 static const char *
 set_auth_tkt_token (cmd_parms *cmd, void *cfg, const char *param)
 {
-  char	**new;
+  char **new;
   auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *) cfg;
 
   new = (char **) apr_array_push(conf->auth_token);
@@ -270,12 +274,12 @@ set_auth_tkt_timeout (cmd_parms *cmd, void *cfg, const char *param)
   auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *)cfg;
   int seconds = conf->timeout_sec;
   const char *error;
-        
+
   /* Easy case - looks like all digits */
   if (apr_isdigit(param[0]) && apr_isdigit(param[strlen(param) - 1])) {
     seconds = atoi(param);
   }
-         
+
   /* Harder case - convert units to seconds */
   else {
     error = convert_to_seconds(cmd, param, &seconds);
@@ -286,7 +290,7 @@ set_auth_tkt_timeout (cmd_parms *cmd, void *cfg, const char *param)
   if (seconds == INT_MAX) return ("Integer overflow or invalid number");
 
   conf->timeout_sec = seconds;
-  
+
   return NULL;
 }
 
@@ -294,14 +298,14 @@ static const char *
 set_auth_tkt_timeout_min (cmd_parms *cmd, void *cfg, const char *param)
 {
   auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *)cfg;
-  
+
   int minutes = atoi(param);
-  
+
   if (minutes < 0)        return ("Timeout must be positive");
   if (minutes == INT_MAX) return ("Integer overflow or invalid number");
-  
+
   conf->timeout_sec = minutes * 60;
-  
+
   return NULL;
 }
 
@@ -309,21 +313,21 @@ static const char *
 set_auth_tkt_timeout_refresh (cmd_parms *cmd, void *cfg, const char *param)
 {
   auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *)cfg;
-  
+
   double refresh = atof(param);
 
-  if (refresh < 0 || refresh > 1) 
+  if (refresh < 0 || refresh > 1)
     return "Refresh flag must be between 0 and 1";
-  
+
   conf->timeout_refresh = refresh;
-  
+
   return NULL;
 }
 
 static const char *
 setup_secret (cmd_parms *cmd, void *cfg, const char *param)
 {
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(cmd->server->module_config, &auth_tkt_module);
   sconf->secret = param;
   return NULL;
@@ -332,12 +336,22 @@ setup_secret (cmd_parms *cmd, void *cfg, const char *param)
 static const char *
 setup_old_secret (cmd_parms *cmd, void *cfg, const char *param)
 {
-  auth_tkt_serv_conf *sconf = ap_get_module_config(cmd->server->module_config, 
+  auth_tkt_serv_conf *sconf = ap_get_module_config(cmd->server->module_config,
     &auth_tkt_module);
   sconf->old_secret = param;
   return NULL;
 }
 
+static const char *
+setup_query_separator (cmd_parms *cmd, void *cfg, const char *param)
+{
+  if (strcmp(param, ";") != 0 && strcmp(param, "&") != 0)
+    return "QuerySeparator must be either ';' or '&'.";
+  auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *)cfg;
+  conf->query_separator = param;
+  return NULL;
+}
+
 void
 setup_digest_sz (auth_tkt_serv_conf *sconf)
 {
@@ -355,10 +369,10 @@ setup_digest_sz (auth_tkt_serv_conf *sconf)
 static const char *
 setup_digest_type (cmd_parms *cmd, void *cfg, const char *param)
 {
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(cmd->server->module_config, &auth_tkt_module);
 
-  if (strcmp(param, "MD5") != 0 && 
+  if (strcmp(param, "MD5") != 0 &&
       strcmp(param, "SHA256") != 0 &&
       strcmp(param, "SHA512") != 0)
     return "Digest type must be one of: MD5 | SHA256 | SHA512.";
@@ -391,7 +405,7 @@ set_cookie_expires (cmd_parms *cmd, void *cfg, const char *param)
   if (seconds == INT_MAX) return ("Integer overflow or invalid number");
 
   conf->cookie_expires = seconds;
-  
+
   return NULL;
 }
 
@@ -399,90 +413,93 @@ static const char *
 set_auth_tkt_debug (cmd_parms *cmd, void *cfg, const char *param)
 {
   auth_tkt_dir_conf *conf = (auth_tkt_dir_conf *)cfg;
-  
+
   int debug = atoi(param);
-  
+
   if (debug < 0)        return ("Debug level must be positive");
   if (debug == INT_MAX) return ("Integer overflow or invalid number");
-  
+
   conf->debug = debug;
-  
+
   return NULL;
 }
 
 /* Command table */
 static const command_rec auth_tkt_cmds[] =
 {
-  AP_INIT_TAKE1("TKTAuthLoginURL", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthLoginURL", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, login_url),
     OR_AUTHCFG, "URL to redirect to if authentication fails"),
-  AP_INIT_TAKE1("TKTAuthTimeoutURL", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthTimeoutURL", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, timeout_url),
     OR_AUTHCFG, "URL to redirect to if cookie times-out"),
-  AP_INIT_TAKE1("TKTAuthPostTimeoutURL", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthPostTimeoutURL", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, post_timeout_url),
     OR_AUTHCFG, "URL to redirect to if cookie times-out doing a POST"),
-  AP_INIT_TAKE1("TKTAuthUnauthURL", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthUnauthURL", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, unauth_url),
     OR_AUTHCFG, "URL to redirect to if valid user without required token"),
-  AP_INIT_TAKE1("TKTAuthCookieName", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthCookieName", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, auth_cookie_name),
     OR_AUTHCFG, "name to use for ticket cookie"),
-  AP_INIT_TAKE1("TKTAuthDomain", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthDomain", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, auth_domain),
     OR_AUTHCFG, "domain to use in cookies"),
 #ifndef APACHE13
   /* TKTAuthCookieExpires is not supported under Apache 1.3 */
-  AP_INIT_ITERATE("TKTAuthCookieExpires", set_cookie_expires, 
+  AP_INIT_ITERATE("TKTAuthCookieExpires", set_cookie_expires,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, cookie_expires),
     OR_AUTHCFG, "cookie expiry period, in seconds or units [smhdwMy]"),
 #endif
-  AP_INIT_TAKE1("TKTAuthBackCookieName", ap_set_string_slot, 
+  AP_INIT_TAKE1("TKTAuthBackCookieName", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, back_cookie_name),
-    OR_AUTHCFG, "name to use for back cookie (NULL for none)"),
-  AP_INIT_TAKE1("TKTAuthBackArgName", ap_set_string_slot, 
+    OR_AUTHCFG, "name to use for back cookie (default: none)"),
+  AP_INIT_TAKE1("TKTAuthBackArgName", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, back_arg_name),
-    OR_AUTHCFG, "name to use for back url argument (NULL for none)"),
-  AP_INIT_FLAG("TKTAuthIgnoreIP", ap_set_flag_slot, 
+    OR_AUTHCFG, "name to use for back url argument ('None' to not use)"),
+  AP_INIT_FLAG("TKTAuthIgnoreIP", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, ignore_ip),
     OR_AUTHCFG, "whether to ignore remote IP address in ticket"),
-  AP_INIT_FLAG("TKTAuthRequireSSL", ap_set_flag_slot, 
+  AP_INIT_FLAG("TKTAuthRequireSSL", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, require_ssl),
     OR_AUTHCFG, "whether to refuse non-HTTPS requests"),
-  AP_INIT_FLAG("TKTAuthCookieSecure", ap_set_flag_slot, 
+  AP_INIT_FLAG("TKTAuthCookieSecure", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, secure_cookie),
     OR_AUTHCFG, "whether to set secure flag on ticket cookies"),
-  AP_INIT_ITERATE("TKTAuthToken", set_auth_tkt_token, 
+  AP_INIT_ITERATE("TKTAuthToken", set_auth_tkt_token,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, auth_token),
     OR_AUTHCFG, "token required to access this area (NULL for none)"),
-  AP_INIT_ITERATE("TKTAuthTimeout", set_auth_tkt_timeout, 
+  AP_INIT_ITERATE("TKTAuthTimeout", set_auth_tkt_timeout,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, timeout_sec),
     OR_AUTHCFG, "ticket inactivity timeout, in seconds or units [smhdwMy]"),
-  AP_INIT_TAKE1("TKTAuthTimeoutMin", set_auth_tkt_timeout_min, 
+  AP_INIT_TAKE1("TKTAuthTimeoutMin", set_auth_tkt_timeout_min,
     NULL, OR_AUTHCFG, "ticket inactivity timeout, in minutes (deprecated)"),
-  AP_INIT_TAKE1("TKTAuthTimeoutRefresh", set_auth_tkt_timeout_refresh, 
+  AP_INIT_TAKE1("TKTAuthTimeoutRefresh", set_auth_tkt_timeout_refresh,
     NULL, OR_AUTHCFG, "ticket timeout refresh flag (0-1)"),
-  AP_INIT_TAKE1("TKTAuthSecret", setup_secret, 
+  AP_INIT_TAKE1("TKTAuthSecret", setup_secret,
     NULL, RSRC_CONF, "secret key to use in digest"),
-  AP_INIT_TAKE1("TKTAuthSecretOld", setup_old_secret, 
+  AP_INIT_TAKE1("TKTAuthSecretOld", setup_old_secret,
     NULL, RSRC_CONF, "old/alternative secret key to check in digests"),
-  AP_INIT_TAKE1("TKTAuthDigestType", setup_digest_type, 
-    NULL, RSRC_CONF, "digest type to use [MD5|SHA256|SHA512], default MD5"),
+  AP_INIT_TAKE1("TKTAuthDigestType", setup_digest_type,
+    NULL, RSRC_CONF, "digest type to use [MD5|SHA256|SHA512], default: MD5"),
   AP_INIT_FLAG("TKTAuthGuestLogin", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, guest_login),
     OR_AUTHCFG, "whether to log people in as guest if no other auth available"),
   AP_INIT_FLAG("TKTAuthGuestCookie", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, guest_cookie),
-    OR_AUTHCFG, "whether to set a cookie when accepting guest users (default off)"),
-  AP_INIT_TAKE1("TKTAuthGuestUser", ap_set_string_slot, 
+    OR_AUTHCFG, "whether to set a cookie when accepting guest users (default: off)"),
+  AP_INIT_TAKE1("TKTAuthGuestUser", ap_set_string_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, guest_user),
     OR_AUTHCFG, "username to use for guest logins"),
   AP_INIT_FLAG("TKTAuthGuestFallback", ap_set_flag_slot,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, guest_fallback),
-    OR_AUTHCFG, "whether to fall back to guest on an expired ticket (default off)"),
-  AP_INIT_ITERATE("TKTAuthDebug", set_auth_tkt_debug, 
+    OR_AUTHCFG, "whether to fall back to guest on an expired ticket (default: off)"),
+  AP_INIT_ITERATE("TKTAuthDebug", set_auth_tkt_debug,
     (void *)APR_OFFSETOF(auth_tkt_dir_conf, debug),
     OR_AUTHCFG, "debug level (1-3, higher for more debug output)"),
+  AP_INIT_TAKE1("TKTAuthQuerySeparator", setup_query_separator,
+    (void *)APR_OFFSETOF(auth_tkt_dir_conf, query_separator),
+    OR_AUTHCFG, "Character used in query strings to separate arguments (default: ';')"),
   {NULL},
 };
 
@@ -490,28 +507,28 @@ static const command_rec auth_tkt_cmds[] =
 /* Support functions */
 
 /* Parse cookie. Returns 1 if valid, and details in *parsed; 0 if not */
-static int 
+static int
 parse_ticket(request_rec *r, char **magic, auth_tkt *parsed)
 {
   int sepidx, sep2idx;
   char *ticket = *magic;
   int len = strlen(ticket);
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
-  
+
   /* For some reason (some clients?), tickets sometimes come in quoted */
   if (ticket[len-1] == '"') ticket[len-1] = 0;
   if (ticket[0] == '"') *magic = ++ticket;
 
   /* Basic length check for min size */
   if (len <= (sconf->digest_sz + TSTAMP_SZ))
-    return 0; 
-  
+    return 0;
+
   /* See if there is a uid/data separator */
   sepidx = ap_ind(ticket, SEPARATOR);
-  if (sepidx == -1) {	
+  if (sepidx == -1) {    
     /* Ticket either uri-escaped, base64-escaped, or bogus */
     if (strstr(ticket, SEPARATOR_HEX)) {
       ap_unescape_url(ticket);
@@ -519,7 +536,7 @@ parse_ticket(request_rec *r, char **magic, auth_tkt *parsed)
     }
     else {
       /* base64 encoded string always longer than original, so len+1 sufficient */
-      char *buf = (char *) apr_palloc(r->pool, len+1);  
+      char *buf = (char *) apr_palloc(r->pool, len+1);
       apr_base64_decode(buf, ticket);
       sepidx = ap_ind(buf, SEPARATOR);
       /* If still no sepidx, must be bogus */
@@ -532,26 +549,26 @@ parse_ticket(request_rec *r, char **magic, auth_tkt *parsed)
   }
 
   /* Recheck length */
-  if (len <= (sconf->digest_sz + TSTAMP_SZ) || 
-      sepidx < (sconf->digest_sz + TSTAMP_SZ)) 
-    return 0; 
+  if (len <= (sconf->digest_sz + TSTAMP_SZ) ||
+      sepidx < (sconf->digest_sz + TSTAMP_SZ))
+    return 0;
 
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT parse_ticket decoded ticket: '%s'", ticket);
   }
-  
+
   /* Get the user id */
   parsed->uid = apr_palloc(r->pool, sepidx - (sconf->digest_sz + TSTAMP_SZ) + 1);
-  memcpy(parsed->uid, &ticket[(sconf->digest_sz + TSTAMP_SZ)], 
+  memcpy(parsed->uid, &ticket[(sconf->digest_sz + TSTAMP_SZ)],
     sepidx - (sconf->digest_sz + TSTAMP_SZ));
   parsed->uid[sepidx - (sconf->digest_sz + TSTAMP_SZ)] = '\0';
-  
+
   /* Check for tokens */
   sep2idx = ap_ind(&ticket[sepidx+1], SEPARATOR);
   if (sep2idx == -1) {
     if (conf->debug >= 2) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
          "TKT parse_ticket: no tokens");
     }
     parsed->tokens = apr_palloc(r->pool, 1);
@@ -563,15 +580,15 @@ parse_ticket(request_rec *r, char **magic, auth_tkt *parsed)
     sepidx = tmp + sep2idx + 1;
     sep2idx = tmp;
     if (conf->debug >= 2) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
-        "TKT parse_ticket: tokens found - sep2=%d, sep=%d, len=%d", 
-	sep2idx, sepidx, len);
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
+        "TKT parse_ticket: tokens found - sep2=%d, sep=%d, len=%d",
+    sep2idx, sepidx, len);
     }
     /* Copy tokens to parsed->tokens */
     parsed->tokens = apr_palloc(r->pool, sepidx-sep2idx);
     apr_snprintf(parsed->tokens, sepidx-sep2idx, "%s", &ticket[sep2idx+1]);
     if (conf->debug >= 2) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
         "TKT parse_ticket tokens: '%s'", parsed->tokens);
     }
   }
@@ -579,25 +596,25 @@ parse_ticket(request_rec *r, char **magic, auth_tkt *parsed)
   /* Copy user data to parsed->user_data */
   parsed->user_data = apr_palloc(r->pool, len-sepidx+1);
   apr_snprintf(parsed->user_data, len-sepidx+1, "%s", &ticket[sepidx+1]);
-  
+
   /* Copy timestamp to parsed->timestamp */
   sscanf(&ticket[sconf->digest_sz], "%8x", &(parsed->timestamp));
-  
+
   return 1;
 }
 
 /* Search cookie headers for our ticket */
-static int 
+static int
 cookie_match(void *result, const char *key, const char *cookie)
 {
   cookie_res * cr = (cookie_res *) result;
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(cr->r->per_dir_config, &auth_tkt_module);
-  
+
   if (cookie != NULL) {
     char *cookie_name, *value, *cookiebuf, *end;
     if (conf->debug >= 2) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r,
         "TKT cookie_match, key %s against <%s> (name=%s)",
         key, cookie, cr->cookie_name);
     }
@@ -623,7 +640,7 @@ cookie_match(void *result, const char *key, const char *cookie)
       if (strlen(cookiebuf)) {
         cr->cookie = cookiebuf;
         if (conf->debug >= 1) {
-          ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r, 
+          ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r,
             "TKT cookie_match: found '%s'", cookiebuf);
         }
         return(0);
@@ -631,7 +648,7 @@ cookie_match(void *result, const char *key, const char *cookie)
     }
   }
   if (conf->debug >= 2) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, cr->r,
      "TKT cookie_match: NOT found");
   }
   return (1);
@@ -639,7 +656,7 @@ cookie_match(void *result, const char *key, const char *cookie)
 
 /* Return the domain to use in cookies */
 char *
-get_domain(request_rec *r, auth_tkt_dir_conf *conf) 
+get_domain(request_rec *r, auth_tkt_dir_conf *conf)
 {
   /* Set the cookie domain to the first set of TKTAuthDomain,
      X-Forwarded-Host, Host, or server hostname. Viljo Viitanen
@@ -665,7 +682,7 @@ get_domain(request_rec *r, auth_tkt_dir_conf *conf)
 static void
 send_auth_cookie(request_rec *r, char *value)
 {
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   char *cookie, *expires;
   char *domain = get_domain(r,conf);
@@ -679,12 +696,12 @@ send_auth_cookie(request_rec *r, char *value)
 #ifndef APACHE13
   if (conf->cookie_expires > 0) {
     apr_time_exp_t tms;
-    apr_time_exp_gmt(&tms, r->request_time + 
+    apr_time_exp_gmt(&tms, r->request_time +
       apr_time_from_sec(conf->cookie_expires));
-    expires = 
+    expires =
       apr_psprintf(r->pool, "; expires=%s, %.2d-%s-%.2d %.2d:%.2d:%.2d GMT",
         apr_day_snames[tms.tm_wday],
-        tms.tm_mday, 
+        tms.tm_mday,
         apr_month_snames[tms.tm_mon],
         tms.tm_year % 100,
         tms.tm_hour, tms.tm_min, tms.tm_sec
@@ -693,12 +710,12 @@ send_auth_cookie(request_rec *r, char *value)
 #endif
 
   /* Send the cookie */
-  cookie = apr_psprintf(r->pool, "%s=%s; path=/%s%s%s", 
+  cookie = apr_psprintf(r->pool, "%s=%s; path=/%s%s%s",
     conf->auth_cookie_name, value, domain, expires, secure_cookie);
   apr_table_setn(r->err_headers_out, "Set-Cookie", cookie);
 
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT: sending cookie: %s=%s; path=/%s%s%s",
         conf->auth_cookie_name, value, domain, expires, secure_cookie);
   }
@@ -708,7 +725,7 @@ send_auth_cookie(request_rec *r, char *value)
 static char *
 get_url_ticket(request_rec *r)
 {
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   const char *args = NULL;  /* url arguments string  */
   const char *key, *val;
@@ -717,12 +734,12 @@ get_url_ticket(request_rec *r)
   /* Use main request args if subrequest */
   request_rec *r_main = r->main == NULL ? r : r->main;
   if (r_main->args != NULL) {
-    args = apr_pstrdup(r->pool, r_main->args); 
+    args = apr_pstrdup(r->pool, r_main->args);
   }
 
   if (args != NULL) {
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
         "TKT: looking for ticket in url: <%s>", args);
     }
 
@@ -731,12 +748,12 @@ get_url_ticket(request_rec *r)
 
       if (strcmp(key,conf->auth_cookie_name) == 0) {
         if (conf->debug >= 1) {
-          ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+          ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
             "TKT: found url ticket: <%s>", val);
         }
 
         /* Setup auth cookie using ticket value */
-        send_auth_cookie(r, (char *) val); 
+        send_auth_cookie(r, (char *) val);
 
         /* Found ticket - ignore rest of arguments */
         ticket = (char *) val;
@@ -749,12 +766,12 @@ get_url_ticket(request_rec *r)
 }
 
 /* Look for a cookie ticket */
-static char * 
+static char *
 get_cookie_ticket(request_rec *r)
 {
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
 
   /* Walk cookie headers looking for matching ticket */
@@ -770,7 +787,7 @@ get_cookie_ticket(request_rec *r)
   }
   if (strlen(cr->cookie) < sconf->digest_sz + TSTAMP_SZ) {
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
         "TKT get_cookie_tkt: found cookie ticket, "
         "but it's too short for a %s digest (%zu < %d)",
         sconf->digest_type, strlen(cr->cookie), sconf->digest_sz + TSTAMP_SZ);
@@ -782,18 +799,18 @@ get_cookie_ticket(request_rec *r)
 }
 
 /* Generate a ticket digest string from the given details */
-static char * 
+static char *
 ticket_digest(request_rec *r, auth_tkt *parsed, unsigned int timestamp, const char *secret)
 {
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   char *uid = parsed->uid;
   char *tokens = parsed->tokens;
   char *user_data = parsed->user_data;
 
-  unsigned char *buf = apr_palloc(r->pool, 
+  unsigned char *buf = apr_palloc(r->pool,
     TSTAMP_SZ + strlen(secret) + strlen(uid) + 1 + strlen(tokens) + 1 + strlen(user_data) + 1);
   unsigned char *buf2 = apr_palloc(r->pool, sconf->digest_sz + strlen(secret));
   int len = 0;
@@ -812,7 +829,7 @@ ticket_digest(request_rec *r, auth_tkt *parsed, unsigned int timestamp, const ch
   if (timestamp == 0) timestamp = parsed->timestamp;
 
   if (conf->debug >= 2) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT ticket_digest: using secret '%s', ip '%s', ts '%d'", secret, remote_ip, timestamp);
   }
 
@@ -824,13 +841,13 @@ ticket_digest(request_rec *r, auth_tkt *parsed, unsigned int timestamp, const ch
   buf[0] = (unsigned char ) ((ip & 0xff000000) >> 24);
   buf[1] = (unsigned char ) ((ip & 0xff0000) >> 16);
   buf[2] = (unsigned char ) ((ip & 0xff00) >> 8);
-  buf[3] = (unsigned char ) ((ip & 0xff));  
-  buf[4] = (unsigned char ) ((timestamp	& 0xff000000) >> 24);
-  buf[5] = (unsigned char ) ((timestamp	& 0xff0000) >> 16);
-  buf[6] = (unsigned char ) ((timestamp	& 0xff00) >> 8);
-  buf[7] = (unsigned char ) ((timestamp	& 0xff));  
+  buf[3] = (unsigned char ) ((ip & 0xff));
+  buf[4] = (unsigned char ) ((timestamp    & 0xff000000) >> 24);
+  buf[5] = (unsigned char ) ((timestamp    & 0xff0000) >> 16);
+  buf[6] = (unsigned char ) ((timestamp    & 0xff00) >> 8);
+  buf[7] = (unsigned char ) ((timestamp    & 0xff));
   len = 8;
-  
+
   /* Append remaining components to buf */
   strcpy((char *)&buf[len], secret);
   len += strlen(secret);
@@ -857,7 +874,7 @@ ticket_digest(request_rec *r, auth_tkt *parsed, unsigned int timestamp, const ch
     digest = ap_md5_binary(r->pool, buf, len);
   }
   if (conf->debug >= 3) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT ticket_digest: digest0: '%s' (input length %d)", digest, len);
   }
 
@@ -879,7 +896,7 @@ ticket_digest(request_rec *r, auth_tkt *parsed, unsigned int timestamp, const ch
     digest = ap_md5_binary(r->pool, buf2, len);
   }
   if (conf->debug >= 3) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT ticket_digest: digest: '%s'", digest);
   }
 
@@ -897,21 +914,21 @@ valid_ticket(request_rec *r, const char *source, char *ticket, auth_tkt *parsed,
   char *digest;
   auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
 
   /* Attempt to parse ticket */
   if (! parse_ticket(r, &ticket, parsed)) {
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r,
         "TKT valid_ticket: unparseable %s ticket found ('%s')", source, ticket);
     }
     return 0;
   }
 
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
-      "TKT valid_ticket: (parsed) uid '%s', tokens '%s', user_data '%s', ts '%d'", 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
+      "TKT valid_ticket: (parsed) uid '%s', tokens '%s', user_data '%s', ts '%d'",
       parsed->uid, parsed->tokens, parsed->user_data, parsed->timestamp);
   }
 
@@ -921,9 +938,9 @@ valid_ticket(request_rec *r, const char *source, char *ticket, auth_tkt *parsed,
 
     /* Digest mismatch - if no old secret set, fail */
     if(sconf->old_secret == NULL) {
-      ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r,
         "TKT valid_ticket: ticket hash (current secret) is invalid, and no old secret set "
-        "- digest '%s', ticket '%s'", 
+        "- digest '%s', ticket '%s'",
         digest, ticket);
       return 0;
     }
@@ -931,13 +948,13 @@ valid_ticket(request_rec *r, const char *source, char *ticket, auth_tkt *parsed,
     /* Digest mismatch - if old_secret is set, recalculate using that */
     else {
       if (conf->debug >= 1) {
-        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
           "TKT valid_ticket: ticket hash (current secret) is invalid, but old_secret is set - checking ticket digest against that");
       }
       digest = ticket_digest(r, parsed, 0, sconf->old_secret);
       if (memcmp(ticket, digest, sconf->digest_sz) != 0) {
-        ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r, 
-          "TKT valid_ticket: ticket hash (old secret) is also invalid - digest '%s', ticket '%s'", 
+        ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r,
+          "TKT valid_ticket: ticket hash (old secret) is also invalid - digest '%s', ticket '%s'",
           digest, ticket);
         return 0;
       }
@@ -946,7 +963,7 @@ valid_ticket(request_rec *r, const char *source, char *ticket, auth_tkt *parsed,
       else {
         if (force_refresh != NULL) {
           if (conf->debug >= 1) {
-            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
               "TKT valid_ticket: ticket_digest validated with old_secret - forcing a cookie refresh");
           }
           *force_refresh = 1;
@@ -958,31 +975,31 @@ valid_ticket(request_rec *r, const char *source, char *ticket, auth_tkt *parsed,
   return 1;
 }
 
-/* Check for required auth tokens 
+/* Check for required auth tokens
  * Returns 1 on success, 0 on failure */
 static int
 check_tokens(request_rec *r, char *tokens)
 {
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   char *next_parsed_token;
   const char *t = NULL;
-  int match = 0; 
+  int match = 0;
 
   /* Success if no tokens required */
-  if (conf->auth_token->nelts == 0 || 
+  if (conf->auth_token->nelts == 0 ||
       strcmp(((char **) conf->auth_token->elts)[0], "NULL") == 0) {
     return 1;
   }
   /* Failure if required and no user tokens found */
   if (tokens == NULL || strlen(tokens) == 0) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT: no matching tokens! (no user tokens found)");
     return 0;
   }
 
-  t = apr_pstrdup(r->pool, tokens); 
-  
+  t = apr_pstrdup(r->pool, tokens);
+
   while (*t && (next_parsed_token = ap_getword(r->pool, &t, ','))) {
     char ** auth_tokens = (char **) conf->auth_token->elts;
     int i;
@@ -990,16 +1007,16 @@ check_tokens(request_rec *r, char *tokens)
     for (i=0; i < conf->auth_token->nelts; i++) {
       int token_len = strlen(auth_tokens[i]);
       if (strncmp(auth_tokens[i], next_parsed_token, token_len) == 0 &&
-	  next_parsed_token[token_len] == 0) {
-	match = 1;
-	break;
+      next_parsed_token[token_len] == 0) {
+    match = 1;
+    break;
       }
     }
     if (match) break;
   }
 
   if (conf->debug >= 1 && ! match) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT: no matching tokens! (user tokens '%s')", tokens);
   }
 
@@ -1010,24 +1027,24 @@ check_tokens(request_rec *r, char *tokens)
 static void
 refresh_cookie(request_rec *r, auth_tkt *parsed, int timeout, int force_flag)
 {
-  auth_tkt_serv_conf *sconf = 
+  auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
 
   /* The timeout refresh is a double between 0 and 1, signifying what
-   * proportion of the timeout should be left before we refresh i.e. 
+   * proportion of the timeout should be left before we refresh i.e.
    * 0 means never refresh (hard timeouts); 1 means always refresh;
-   * .33 means only refresh if less than a third of the timeout 
-   * period remains. */ 
+   * .33 means only refresh if less than a third of the timeout
+   * period remains. */
   unsigned int now = time(NULL);
   int remainder = parsed->timestamp + timeout - now;
   double refresh_sec = conf->timeout_refresh * timeout;
 
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT refresh_cookie: timeout %d, refresh %.3f, remainder %d, refresh_sec %.3f, force_flag %d",
-	timeout, conf->timeout_refresh, remainder, refresh_sec, force_flag);
+    timeout, conf->timeout_refresh, remainder, refresh_sec, force_flag);
   }
 
   /* If less than our refresh_sec threshold, freshen the cookie */
@@ -1036,29 +1053,29 @@ refresh_cookie(request_rec *r, auth_tkt *parsed, int timeout, int force_flag)
     char *digest = ticket_digest(r, parsed, now, sconf->secret);
     if (parsed->tokens) {
       ticket = apr_psprintf(r->pool,
-        "%s%08x%s%c%s%c%s", 
-          digest, now, parsed->uid, 
-	  SEPARATOR, parsed->tokens, 
-	  SEPARATOR, parsed->user_data);
+        "%s%08x%s%c%s%c%s",
+          digest, now, parsed->uid,
+      SEPARATOR, parsed->tokens,
+      SEPARATOR, parsed->user_data);
     }
     else {
       ticket = apr_psprintf(r->pool,
-        "%s%08x%s%c%s", 
+        "%s%08x%s%c%s",
           digest, now, parsed->uid, SEPARATOR, parsed->user_data);
     }
     ticket_base64 = ap_pbase64encode(r->pool, ticket);
 
-    send_auth_cookie(r, ticket_base64); 
+    send_auth_cookie(r, ticket_base64);
   }
 }
-  
-/* Check whether the given timestamp has timed out 
+
+/* Check whether the given timestamp has timed out
  * Returns 1 if okay, 0 if timed out */
 static int
 check_timeout(request_rec *r, auth_tkt *parsed)
 {
   char *timeout_date, *timeout_cookie;
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   unsigned int now = time(NULL);
   unsigned int timestamp = parsed->timestamp;
@@ -1073,24 +1090,24 @@ check_timeout(request_rec *r, auth_tkt *parsed)
   /* Check whether timestamp is still fresh */
   if (timestamp + timeout >= now) {
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
-        "TKT: cookie timeout still good: now %d, timeout: %d, tstamp: %d", 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
+        "TKT: cookie timeout still good: now %d, timeout: %d, tstamp: %d",
         now, timeout, timestamp);
     }
 
     /* Check whether to refresh the cookie */
-    if (conf->timeout_refresh > 0) 
+    if (conf->timeout_refresh > 0)
       refresh_cookie(r, parsed, timeout, CHECK_REFRESH);
 
     return 1;
   }
 
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
-      "TKT: ticket timed out: now %d, timeout: %d, tstamp: %d", 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
+      "TKT: ticket timed out: now %d, timeout: %d, tstamp: %d",
       now, timeout, timestamp);
   }
-    
+
   /* Delete cookie (set expired) if invalid, in case we want to set from url */
   timeout_date = ap_ht_time(r->pool, now - 3600, "%a %d %b %Y %T %Z", 0);
   timeout_cookie = domain ?
@@ -1106,7 +1123,7 @@ check_timeout(request_rec *r, auth_tkt *parsed)
 }
 
 /* Strip specified query args from a url */
-static char * 
+static char *
 query_strip(request_rec *r, const char *strip)
 {
   const char *args = NULL;  /* url arguments string  */
@@ -1116,10 +1133,10 @@ query_strip(request_rec *r, const char *strip)
 
   /* Use main request args if subrequest */
   request_rec *r_main = r->main == NULL ? r : r->main;
-  if (r_main->args == NULL || strip == NULL) 
+  if (r_main->args == NULL || strip == NULL)
     return NULL;
 
-  args = apr_pstrdup(r->pool, r_main->args); 
+  args = apr_pstrdup(r->pool, r_main->args);
 
   /* Convert all '&' to ';' */
   while ((p = ap_strchr(args, '&')))
@@ -1130,7 +1147,7 @@ query_strip(request_rec *r, const char *strip)
     key = ap_getword(r->pool, &val, '=');
 
     /* Add to new_args only if key != strip */
-    if (strlen(strip) != strlen(key) || strncmp(key,strip,strlen(strip)) != 0) 
+    if (strlen(strip) != strlen(key) || strncmp(key,strip,strlen(strip)) != 0)
       new_args = apr_psprintf(r->pool, "%s&%s=%s", new_args, key, val);
   }
 
@@ -1155,14 +1172,14 @@ c2x(unsigned what, unsigned char *where)
 }
 
 /* Extra escaping - variant of httpd util.c ap_escape_path_segment */
-static char * 
+static char *
 escape_extras(apr_pool_t *p, const char *segment)
 {
   char *copy = apr_palloc(p, 3 * strlen(segment) + 1);
   const unsigned char *s = (const unsigned char *)segment;
   unsigned char *d = (unsigned char *)copy;
   unsigned c;
-  
+
   while ((c = *s)) {
     if (c == '=' || c == '&' || c == ':') {
       d = c2x(c, d);
@@ -1177,16 +1194,17 @@ escape_extras(apr_pool_t *p, const char *segment)
 }
 
 /* External redirect to the given url, setting back cookie or arg */
-static int 
+static int
 redirect(request_rec *r, char *location)
 {
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
 
   char *domain = get_domain(r,conf);
   char *back_cookie_name = conf->back_cookie_name;
   char *back_arg_name = conf->back_arg_name;
-  char *url, *cookie, *back;
+  char *url = location;
+  char *cookie, *back;
   const char *hostinfo = 0;
   int port;
 
@@ -1209,10 +1227,10 @@ redirect(request_rec *r, char *location)
   if (! hostinfo) hostinfo = apr_table_get(r->headers_in, "Host");
   if (! hostinfo) {
     /* Fallback to using r->hostname and the server port. This usually
-       works, but behind a reverse proxy the port may well be wrong. 
+       works, but behind a reverse proxy the port may well be wrong.
        On the other hand, it's really the proxy's problem, not ours.
     */
-    ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r,
       "TKT: could not find Host header, falling back to hostname/server port");
     port = ap_get_server_port(r);
     hostinfo = port == apr_uri_default_port_for_scheme(scheme) ?
@@ -1222,22 +1240,22 @@ redirect(request_rec *r, char *location)
 
   /* If no scheme, assume location is relative and expand using scheme and hostinfo */
   if (strncasecmp(location, "http", 4) != 0) {
-    char *old_location = apr_pstrdup(r->pool, location); 
+    char *old_location = apr_pstrdup(r->pool, location);
     location = apr_psprintf(r->pool, "%s://%s/%s", scheme, hostinfo, location);
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
         "TKT relative URL '%s' expanded to '%s'", old_location, location);
     }
   }
 
   /* Setup back URL */
-  back = apr_psprintf(r->pool, "%s://%s%s%s", 
+  back = apr_psprintf(r->pool, "%s://%s%s%s",
     scheme, hostinfo, r->uri, query);
   if (conf->debug >= 1) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT: back url '%s'", back);
   }
-  
+
   /* Escape testing */
   back = ap_escape_path_segment(r->pool, back);
   back = escape_extras(r->pool, back);
@@ -1245,9 +1263,9 @@ redirect(request_rec *r, char *location)
   /* Set back cookie if name is not null */
   if (back_cookie_name) {
     cookie = domain ?
-      apr_psprintf(r->pool, "%s=%s; path=/; domain=%s", 
+      apr_psprintf(r->pool, "%s=%s; path=/; domain=%s",
         back_cookie_name, back, domain) :
-      apr_psprintf(r->pool, "%s=%s; path=/", 
+      apr_psprintf(r->pool, "%s=%s; path=/",
         back_cookie_name, back);
 
     apr_table_setn(r->err_headers_out, "Set-Cookie", cookie);
@@ -1255,18 +1273,18 @@ redirect(request_rec *r, char *location)
   }
 
   /* If back_cookie_name not set, add a back url argument to url */
-  else {
-    char sep = ap_strchr(location, '?') ? ';' : '?';
-    url = apr_psprintf(r->pool, "%s%c%s=%s", 
+  else if (back_arg_name) {
+    char sep = ap_strchr(location, '?') ? conf->query_separator[0] : '?';
+    url = apr_psprintf(r->pool, "%s%c%s=%s",
       location, sep, back_arg_name, back);
   }
 
   if (conf->debug >= 2) {
-    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r,
       "TKT: redirect '%s'", url);
   }
   apr_table_setn(r->headers_out, "Location", url);
-  
+
   return HTTP_TEMPORARY_REDIRECT;
 }
 
@@ -1308,14 +1326,14 @@ get_guest_uid(request_rec *r, auth_tkt_dir_conf *conf)
     if (regm[1].rm_so != -1) {
       uuid_length_str = ap_pregsub(r->pool, "$1", guest_user,
         UUID_SUBS, regm);
-      if (uuid_length_str) 
+      if (uuid_length_str)
         uuid_length = atoi(uuid_length_str);
     }
     if (uuid_length <= 0 || uuid_length > APR_UUID_FORMATTED_LENGTH) {
       uuid_length = APR_UUID_FORMATTED_LENGTH;
     }
     if (conf->debug >= 1) {
-      ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r, 
+      ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r,
         "TKT: %%U found in guest user (length %d)", uuid_length);
     }
     /* Generate the UUID */
@@ -1323,7 +1341,7 @@ get_guest_uid(request_rec *r, auth_tkt_dir_conf *conf)
     uuid_str = apr_palloc(r->pool, APR_UUID_FORMATTED_LENGTH + 1);
     apr_uuid_get(uuid);
     apr_uuid_format(uuid_str, uuid);
-    if (uuid_length < APR_UUID_FORMATTED_LENGTH) 
+    if (uuid_length < APR_UUID_FORMATTED_LENGTH)
       uuid_str[uuid_length] = '\0';
     /* Generate the new guest_user string */
     guest_user_length = strlen(guest_user);
@@ -1338,7 +1356,7 @@ get_guest_uid(request_rec *r, auth_tkt_dir_conf *conf)
     else
       uuid_post = "";
 
-    return apr_psprintf(r->pool, "%s%s%s", 
+    return apr_psprintf(r->pool, "%s%s%s",
       uuid_pre, uuid_str, uuid_post);
   }
 
@@ -1348,7 +1366,7 @@ get_guest_uid(request_rec *r, auth_tkt_dir_conf *conf)
 }
 
 /* Set up the guest user info */
-static int 
+static int
 setup_guest(request_rec *r, auth_tkt_dir_conf *conf, auth_tkt *tkt)
 {
   /* Only applicable if guest access on */
@@ -1359,8 +1377,8 @@ setup_guest(request_rec *r, auth_tkt_dir_conf *conf, auth_tkt *tkt)
   tkt->uid = get_guest_uid(r, conf);
   tkt->user_data = "";
   tkt->tokens = "";
-  ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r, 
-    "TKT: no valid ticket found - accepting as guest user '%s'", 
+  ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r,
+    "TKT: no valid ticket found - accepting as guest user '%s'",
       tkt->uid);
 
   return 1;
@@ -1368,36 +1386,37 @@ setup_guest(request_rec *r, auth_tkt_dir_conf *conf, auth_tkt *tkt)
 
 /* ----------------------------------------------------------------------- */
 /* Debug routines */
-void 
-dump_config(request_rec *r, auth_tkt_serv_conf *sconf, auth_tkt_dir_conf *conf) 
+void
+dump_config(request_rec *r, auth_tkt_serv_conf *sconf, auth_tkt_dir_conf *conf)
 {
   /* Dump config settings */
   fprintf(stderr,"[ mod_auth_tkt config ]\n");
   fprintf(stderr,"URI: %s\n", r->uri);
-  fprintf(stderr,"Filename: %s\n",                    r->filename);
-  fprintf(stderr,"TKTAuthSecret: %s\n", 	            sconf->secret);
-  fprintf(stderr,"TKTAuthSecretOld: %s\n", 	            sconf->old_secret);
-  fprintf(stderr,"TKTAuthDigestType: %s\n", 	        sconf->digest_type);
-  fprintf(stderr,"digest_sz: %d\n", 	                sconf->digest_sz);
-  fprintf(stderr,"directory: %s\n", 		            conf->directory);
-  fprintf(stderr,"TKTAuthLoginURL: %s\n", 	        conf->login_url);
-  fprintf(stderr,"TKTAuthTimeoutURL: %s\n", 	        conf->timeout_url);
-  fprintf(stderr,"TKTAuthPostTimeoutURL: %s\n",	    conf->post_timeout_url);
-  fprintf(stderr,"TKTAuthUnauthURL: %s\n", 	        conf->unauth_url);
-  fprintf(stderr,"TKTAuthCookieName: %s\n", 	        conf->auth_cookie_name);
-  fprintf(stderr,"TKTAuthDomain: %s\n", 	            conf->auth_domain);
-  fprintf(stderr,"TKTAuthCookieExpires: %d\n", 	    conf->cookie_expires);
-  fprintf(stderr,"TKTAuthBackCookieName: %s\n",	    conf->back_cookie_name);
-  fprintf(stderr,"TKTAuthBackArgName: %s\n",	        conf->back_arg_name);
-  fprintf(stderr,"TKTAuthIgnoreIP: %d\n",	            conf->ignore_ip);
-  fprintf(stderr,"TKTAuthRequireSSL: %d\n", 	        conf->require_ssl);
-  fprintf(stderr,"TKTAuthCookieSecure: %d\n", 	    conf->secure_cookie);
-  fprintf(stderr,"TKTAuthTimeoutMin: %d\n", 	        conf->timeout_sec);
-  fprintf(stderr,"TKTAuthTimeoutRefresh: %f\n",	    conf->timeout_refresh);
-  fprintf(stderr,"TKTAuthGuestLogin: %d\n",           conf->guest_login);
-  fprintf(stderr,"TKTAuthGuestCookie: %d\n",          conf->guest_cookie);
-  fprintf(stderr,"TKTAuthGuestUser: %s\n",            conf->guest_user);
-  fprintf(stderr,"TKTAuthGuestFallback %d\n",         conf->guest_fallback);
+  fprintf(stderr,"Filename: %s\n",                      r->filename);
+  fprintf(stderr,"TKTAuthSecret: %s\n",                 sconf->secret);
+  fprintf(stderr,"TKTAuthSecretOld: %s\n",              sconf->old_secret);
+  fprintf(stderr,"TKTAuthDigestType: %s\n",             sconf->digest_type);
+  fprintf(stderr,"digest_sz: %d\n",                     sconf->digest_sz);
+  fprintf(stderr,"directory: %s\n",                     conf->directory);
+  fprintf(stderr,"TKTAuthLoginURL: %s\n",               conf->login_url);
+  fprintf(stderr,"TKTAuthTimeoutURL: %s\n",             conf->timeout_url);
+  fprintf(stderr,"TKTAuthPostTimeoutURL: %s\n",         conf->post_timeout_url);
+  fprintf(stderr,"TKTAuthUnauthURL: %s\n",              conf->unauth_url);
+  fprintf(stderr,"TKTAuthCookieName: %s\n",             conf->auth_cookie_name);
+  fprintf(stderr,"TKTAuthDomain: %s\n",                 conf->auth_domain);
+  fprintf(stderr,"TKTAuthCookieExpires: %d\n",          conf->cookie_expires);
+  fprintf(stderr,"TKTAuthBackCookieName: %s\n",         conf->back_cookie_name);
+  fprintf(stderr,"TKTAuthBackArgName: %s\n",            conf->back_arg_name);
+  fprintf(stderr,"TKTAuthIgnoreIP: %d\n",               conf->ignore_ip);
+  fprintf(stderr,"TKTAuthRequireSSL: %d\n",             conf->require_ssl);
+  fprintf(stderr,"TKTAuthCookieSecure: %d\n",           conf->secure_cookie);
+  fprintf(stderr,"TKTAuthTimeoutMin: %d\n",             conf->timeout_sec);
+  fprintf(stderr,"TKTAuthTimeoutRefresh: %f\n",         conf->timeout_refresh);
+  fprintf(stderr,"TKTAuthGuestLogin: %d\n",             conf->guest_login);
+  fprintf(stderr,"TKTAuthGuestCookie: %d\n",            conf->guest_cookie);
+  fprintf(stderr,"TKTAuthGuestUser: %s\n",              conf->guest_user);
+  fprintf(stderr,"TKTAuthGuestFallback %d\n",           conf->guest_fallback);
+  fprintf(stderr,"TKTAuthQuerySeparator: %c\n",         conf->query_separator);
   if (conf->auth_token->nelts > 0) {
     char ** auth_token = (char **) conf->auth_token->elts;
     int i;
@@ -1416,7 +1435,7 @@ auth_tkt_check(request_rec *r)
 {
   char *ticket;
   auth_tkt *parsed = apr_palloc(r->pool, sizeof(*parsed));
-  auth_tkt_dir_conf *conf = 
+  auth_tkt_dir_conf *conf =
     ap_get_module_config(r->per_dir_config, &auth_tkt_module);
   auth_tkt_serv_conf *sconf =
     ap_get_module_config(r->server->module_config, &auth_tkt_module);
@@ -1432,6 +1451,10 @@ auth_tkt_check(request_rec *r)
     setup_digest_sz(sconf);
   }
 
+  /* Map "None" back_arg_name to NULL */
+  if (conf->back_arg_name && strcmp(conf->back_arg_name, "None") == 0)
+    conf->back_arg_name = NULL;
+
   /* Dump config if debugging */
   if (conf->debug >= 2)
     dump_config(r, sconf, conf);
@@ -1442,21 +1465,21 @@ auth_tkt_check(request_rec *r)
   }
   /* Module misconfigured unless secret set */
   if (! sconf->secret) {
-    ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r,
       "TKT: TKTAuthSecret missing");
     return HTTP_INTERNAL_SERVER_ERROR;
   }
   /* Redirect/login if scheme not "https" and require_ssl is set */
   if (conf->require_ssl > 0 && strcmp(scheme,"https") != 0) {
-    ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r,
       "TKT: redirect/login - unsecured request, TKTAuthRequireSSL is on");
     return redirect(r, conf->login_url);
   }
   /* Backwards compatibility mode for TKTAuthRequireSSL */
   if (conf->require_ssl > 0 && conf->secure_cookie == -1) {
-    /* Set secure_cookie flag if require_ssl is set and secure_cookie is 
+    /* Set secure_cookie flag if require_ssl is set and secure_cookie is
        undefined (as opposed to 'off') */
-    ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r, 
+    ap_log_rerror(APLOG_MARK, APLOG_WARNING, APR_SUCCESS, r,
       "TKT: TKTAuthRequireSSL on, but no TKTAuthCookieSecure found - "
       "please set TKTAuthCookieSecure explicitly, assuming 'on'");
     conf->secure_cookie = 1;
@@ -1472,13 +1495,13 @@ auth_tkt_check(request_rec *r)
       }
       if (! guest) {
         if (conf->login_url) {
-          ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r, 
+          ap_log_rerror(APLOG_MARK, APLOG_INFO, APR_SUCCESS, r,
             "TKT: no valid ticket found - redirecting to login url");
           return redirect(r, conf->login_url);
         }
         else {
           /* Fatal error: guest setup failed, but we have no login url defined */
-          ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, 
+          ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r,
             "TKT: guest login failed and no login url to fall back to - aborting");
           return HTTP_INTERNAL_SERVER_ERROR;
         }
@@ -1505,7 +1528,7 @@ auth_tkt_check(request_rec *r)
       }
       else {
         /* Fatal error: guest setup failed, but we have no url to redirect to */
-        ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, 
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r,
           "TKT: ticket timeout, guest login failed, and no url to fall back to - aborting");
         return HTTP_INTERNAL_SERVER_ERROR;
       }
@@ -1546,11 +1569,11 @@ auth_tkt_check(request_rec *r)
 /* Apache 1.3 style */
 
 module MODULE_VAR_EXPORT auth_tkt_module = {
-  STANDARD_MODULE_STUFF, 
+  STANDARD_MODULE_STUFF,
   auth_tkt_version,             /* initializer */
-  create_auth_tkt_config,	/* create per-dir    config structures */
-  merge_auth_tkt_config,	/* merge  per-dir    config structures */
-  create_auth_tkt_serv_config,	/* create per-server config structures */
+  create_auth_tkt_config,       /* create per-dir    config structures */
+  merge_auth_tkt_config,        /* merge  per-dir    config structures */
+  create_auth_tkt_serv_config,  /* create per-server config structures */
   merge_auth_tkt_serv_config,   /* merge  per-server config structures */
   auth_tkt_cmds,                /* table of config file commands       */
   NULL,                         /* handlers */
@@ -1580,10 +1603,10 @@ auth_tkt_register_hooks (apr_pool_t *p)
 
 /* Declare and populate the main module data structure */
 module AP_MODULE_DECLARE_DATA auth_tkt_module = {
-  STANDARD20_MODULE_STUFF, 
-  create_auth_tkt_config,	/* create per-dir    config structures */
-  merge_auth_tkt_config,	/* merge  per-dir    config structures */
-  create_auth_tkt_serv_config,	/* create per-server config structures */
+  STANDARD20_MODULE_STUFF,
+  create_auth_tkt_config,       /* create per-dir    config structures */
+  merge_auth_tkt_config,        /* merge  per-dir    config structures */
+  create_auth_tkt_serv_config,  /* create per-server config structures */
   merge_auth_tkt_serv_config,   /* merge  per-server config structures */
   auth_tkt_cmds,                /* table of config file commands       */
   auth_tkt_register_hooks       /* register hooks                      */
@@ -1591,6 +1614,6 @@ module AP_MODULE_DECLARE_DATA auth_tkt_module = {
 
 #endif
 
-/* 
- * vim:sw=2:sm
+/*
+ * vim:sw=2:sm:et
  */
diff --git a/t/extra.conf.1.in b/t/extra.conf.1.in
index 3466a93..7fac764 100644
--- a/t/extra.conf.1.in
+++ b/t/extra.conf.1.in
@@ -240,6 +240,24 @@ TKTAuthDigestType "MD5"
   TKTAuthGuestFallback on
 </Location>
 
+# secret_back_explicit - explicit TKTAuthBackArgName
+<Location /secret_back_explicit>
+  AuthType None
+  require valid-user
+  TKTAuthLoginURL http://localhost/pub/login.cgi
+  TKTAuthBackArgName redirect_to
+  TKTAuthDebug 2
+</Location>
+
+# secret_back_none - null TKTAuthBackArgName
+<Location /secret_back_none>
+  AuthType None
+  require valid-user
+  TKTAuthLoginURL http://localhost/pub/login.cgi
+  TKTAuthBackArgName None
+  TKTAuthDebug 2
+</Location>
+
 # virtual host testing - with per-host secret
 <VirtualHost VHostLocalSecret>
   TKTAuthSecret "vhostlocalsecret"
diff --git a/t/extra.conf.2.in b/t/extra.conf.2.in
index d2e5c03..d0e2770 100644
--- a/t/extra.conf.2.in
+++ b/t/extra.conf.2.in
@@ -346,6 +346,24 @@ TKTAuthDigestType "MD5"
   TKTAuthGuestFallback on
 </Location>
 
+# secret_back_explicit - explicit TKTAuthBackArgName
+<Location /secret_back_explicit>
+  AuthType None
+  require valid-user
+  TKTAuthLoginURL http://localhost/pub/login.cgi
+  TKTAuthBackArgName redirect_to
+  TKTAuthDebug 2
+</Location>
+
+# secret_back_none - null TKTAuthBackArgName
+<Location /secret_back_none>
+  AuthType None
+  require valid-user
+  TKTAuthLoginURL http://localhost/pub/login.cgi
+  TKTAuthBackArgName None
+  TKTAuthDebug 2
+</Location>
+
 # virtual host testing - with per-host secret
 <VirtualHost VHostLocalSecret>
   DocumentRoot @documentroot@/vhost_local_secret