Matt,

 

I have had this problem too. It is related to the image popup window (and document, media and flash) not trasfering the current sessions to the window. The problem is in the browse_img.asp file line 14

 

If InStr(Lcase(ImageGalleryPath),Lcase(trim(Session("ImageGalleryPath")))) <= 0 or Session("ImageGalleryPath") ="" then Response.Write "The area you are attempting to access is forbidden"
Response.End
End If

 

I found flushing the cache does help, it would be useful of CuteSoft would pass a randomize string variable when calling the popup. It dies badly with Mac safari. I added CacheControl and AddHeader (http://support.microsoft.com/kb/q234067/) and it seems to help.

 

On the site security, if you have access to the server, make a user id for the client to login on, lock the directory down to that user account via NT secuirty, and the allow access only to that user account.