Hi. I was wondering about why you protect the path ...

cgi-bin/webscr

which is a Paypal path? I'm assuming ubercart does an https call from withing the payment module to paypal?

Also, if you set "auto-return" to "on" then what path should you use for the return path? If you do this, then I believe ubercart sends an auto-return path as well -- does one override the other. Does ubercart send an ssl return path or is it irrelevant since it will be redirect to the ssl path when Drupal gets it from Paypal. Geez, sorry to dump all of that out there! Any help is grealy appreciated. Ahhh, love doing IPN stuff, so much fun.