--- a/plugins/mod_legacyauth.lua	Thu Aug 13 16:51:35 2009 +0500
+++ b/plugins/mod_legacyauth.lua	Thu Aug 13 16:53:18 2009 +0500
@@ -53,7 +53,7 @@
 						success, err_type, err, err_msg = sessionmanager.bind_resource(session, resource);
 						if not success then
 							session.send(st.error_reply(stanza, err_type, err, err_msg));
-							return true;
+							return true; -- FIXME need to unauthenticate here
 						end
 					end
 					session.send(st.reply(stanza));