sql table weirdness / pref_uid confusion

[liamr@umich.edu]

Our imp installation lies behind a custom login screen (that does kerberos
authentication).  The authentication is cookie based (surprise!).  If you try to
access a resource that requires authentication, and you don't have the correct
cookie, it makes you sign in.

Here's the deal..

Horde 1.3.5 / IMP 2.3.7 seems to be setting two different pref_uids depending on
how I access the site.  These are my entries from the preference tables and the
situations that cause them (i'm pretty sure):

liamr, imp, last_login, 998441799:
- log in to https://mail-test.blah.blah.umich.edu
- authenticate
- select "horde (dev)" from the index.html "service" menu i set up in the
  docroot
- get the imp login screen

liamr@umich.edu, imp, last_login, 998442896:
- log in to https://mail-test.blah.blah.umich.edu/horde/imp/
- authenticate
- get the imp login screen

horde then seems to set a cookie, so if i quit and come back it remember's which
"version" of me that browser knows about.  if i quit my browser, delete the
cookie, then login to other way, i can usually get it to use the other value.
this happens both with oracle and mysql.

Although my kerberos principal is "liamr@umich.edu", that value doesn't make it 
into the environment.  The cgi portion of the authentication scheme does set 
REMOTE_USER, but only to a user name, not to "user@umich.edu".  I'd assumed that 
pref_uid just got set to whatever login name was used on the horde and imp login 
screens (which seems to be REMOTE_USER by default).

Any ideas?
Liam