Do you randomize the return URLs for URL services. I have noticed in my testing that the return URL is always the same. This means that if I had two separate AwareIM business spaces running and they both accessed the same service, they could potentially get each other's return data as there doesn't seem to be anything in the URL transaction that ties a response to a session or something.
Looking forward to your explanation.
cheers,
ski