Francis,

You are totally right! I forgot that that we were using some crap logic for the variables; we are switching this to $request_method (the actual built in variable). Your notes confirm to me what I was thinking all along: that the client is likely closing the connection after 5 seconds. We are doing a debug session today with tcpdump to get more details.

Thanks for setting me straight!