custom webmail login page

[#1]

I've been trying to make a webpage on my plusnet webspace that has a username and password box for logging into plusnet webmail the rest of the parameters and the prefex for the username are put in by the page. It works fine when I run the page from my computer but once I upload it it fails with the error "You must be logged in to access this page.". Anyone know how to fix this or is it jsut not allowed to be done.

[#2]

could it be something todo with cookies and the way the are being created/requested.
Sorry but no idea until I create something similar 

[#3]

Thats what I was thinking so i did it a different way I was hoping would deal with the cookies properly
"window.open('https://webmail.plus.net/src/redirect.php?login_username=' + document.forms["login"]["login_username"].value + '&secretkey=' + document.forms["login"]["secretkey"].value + '&js_autodetect_results=1&just_logged_in=1&loginServer=PlusNet&rememberLoginServer=true'); "
but the result was the same still the same worked on my computer biit fails while on the webspace.

[#4]

I found out that the problem is the referer it works fine once I disable referer headers in my browser. I think its posible to bypass this with php but i would assume that if its checking the referer then this is not allowed.

[#5]

That's impressive!
not sure we if we do hot-linking rejection. theoretically, should work ok

[#6]

it works fine once you remove the referer info which is pretty simple with php just 1 line
header( 'refresh: 1; url=http://webmail.plus.net/src/redirect.php?login_username=username%2b'.$_GET['username'].'&secretkey='.$_GET['password'].'&js_autodetect_results=0&just_logged_in=0&loginServer=PlusNet&rememberLoginServer=true' );
but alot of places don't liek you removing referer information so i'm not sure if it is allowed or not here.

[#7]

Very true, some sites restricting access to their resources to their own site.
it does make sense but not when the service is already limited to specific people then there is no point at all