eh, avevo già provato con unset($_SERVER['PHP_AUTH_USER']) ma nada...sul php.net ho trovato questo:
"[13 Dec 2000 3:39am CET] rasmus@php.net
It is destroying it, but your browser is sending it again on the next
request so PHP sets it again. There is no way to tell the browser not
to send this variable short of sending another 401 with a different
realm. This is a browser issue and has nothing to do with PHP."