I've been probing around inside the login code like a clumsy dentist in a patient's mouth, but I still can't find the problem.
I've noted that sometimes it's setting up multiple groups of hidden authentication HTML, and I've tried to stop it, any way short of pretending to myself that shutting down Apache is a suitable way to log out. Nothing's working.
Ah well. Doesn't matter at this point. I'll keep on it for an hour, then I've got to get to work. Once I get home at 12:30 or so, it'll either be much clearer, or else I'll be so caffeine-addled that it'll make sense. Six of one, half dozen of the other...