Thanks to everyone who helped with yesterday's web server crisis! :)

The solution with IIS was to: 1) turn off basic authentication for the virtual directory (!!), and 2) turn off IIS' "custom error pages".

What was happening was that when the CGI tried to return HTTP 401 (meaning "I need a username and password please"), IIS would instead return a "user-frienly error page" explaining what HTTP 401 meant, instead of actually returning HTTP 401 which would tell the browser to ask the user for authorization credentials.

I ended up finding the solution tucked in a README file for PCGI, which comes with Zope. This procedure also worked on IIS5 on W2K. What a steaming pile of monkey crap.