You (and people trying to help you) will benefit from my DebugOutput() function posted as a reply to another topic. Go get!!
No. You're supposed to put what BNLS sends into your SID_AUTH_CHECK response as the BNLS protocol specification describes.
How come my posts get deleted!? =)