cacti user authentification bug or misconfiguration?

[acryl]

Hi
i'm running cacti on linux box, and have some troubles with user authentification:
we have a user (user1) for every customer with restricted permissions (he can only see the graphs of his own devices), and a user (user2) who can see all graphs.

the problem is that when we log into cacti with the user2 login and close the web browser (htat means without loging out the user2), and log back with the user1, the user1 have the priveleges of the user2.

I've noticed that this issue can be solved by deleting the cookies of the web browser.

But my actuall problem is that if i copy the url of a graph tree where user1 has permissions to see the graph,while beeing loggged as user2,
then log as user1 (after deleting the cookies), and paste this url, i have the same permissions as user2.

Is this a bug or a misconfiguration, and is there someone who could explain me how the authentification works on cacti?

thanks.

[rony]

Please post an example link that you see this.