diff --git a/README.txt b/README.txt
index 4993ce8..27942bb 100644
--- a/README.txt
+++ b/README.txt
@@ -1,8 +1,8 @@
 This module implements OpenID Provider support for Drupal 6.
 
 By setting up this module, all users on the site get an OpenID in the form of
-http://example.com/user/12345/identity, if the domain name is example.com and 
-the user identifier is 12345. You can automatically alias this URL with 
+http://example.com/user/12345/identity, if the domain name is example.com and
+the user identifier is 12345. You can automatically alias this URL with
 pathauto module.
 
 The module uses the xrds_simple.module API and the Drupal core OpenID API.
diff --git a/openid_provider.inc b/openid_provider.inc
index 292159a..df6dac6 100644
--- a/openid_provider.inc
+++ b/openid_provider.inc
@@ -139,16 +139,25 @@ function openid_provider_authentication_response($request) {
   $response = array_merge($response, module_invoke_all('openid_provider', 'response', $response, $request));
   
   $rp = _openid_provider_rp_load($user->uid, $realm);
-  if ($rp->auto_release) {
-    $response = _openid_provider_sign($response);
-    _openid_provider_rp_save($user->uid, $realm, TRUE);
-    return openid_redirect_http($response['openid.return_to'], $response); 
-  }
-  else {
-    // Unset global post variable, otherwise FAPI will assume it has been 
-    // submitted against openid_provider_form.
-    unset($_POST);
-    return drupal_get_form('openid_provider_form', $response, $realm);
+  if (!$rp) {
+    /* never seen this relaying party, set some sane defaults */
+    $rp = new stdClass();
+    $rp->access = OPENID_PROVIDER_ASK;
+  }
+  switch ($rp->access) {
+    case OPENID_PROVIDER_DENY:
+      $response = openid_provider_cancel_authentication_response($request['openid.mode']);
+      return openid_redirect_http($request['openid.return_to'], $response);
+    case OPENID_PROVIDER_ALLOW:
+      $response = _openid_provider_sign($response);
+      _openid_provider_rp_save($user->uid, $realm, TRUE);
+      return openid_redirect_http($response['openid.return_to'], $response);
+    case OPENID_PROVIDER_ASK:
+    default:
+      // Unset global post variable, otherwise FAPI will assume it has been
+      // submitted against openid_provider_form.
+      unset($_POST);
+      return drupal_get_form('openid_provider_form', $response, $realm);
   }
 }
 
@@ -302,13 +311,13 @@ function _openid_provider_rp_load($uid, $realm = NULL) {
   }
 }
   
-function _openid_provider_rp_save($uid, $realm, $auto_release = FALSE) {
+function _openid_provider_rp_save($uid, $realm, $access = OPENID_PROVIDER_ASK) {
   $rpid = db_result(db_query("SELECT rpid FROM {openid_provider_relying_party} WHERE uid=%d AND realm='%s'", $uid, $realm));
   if ($rpid) {
-    db_query("UPDATE {openid_provider_relying_party} SET auto_release=%d, last_time=%d WHERE rpid=%d", $auto_release, time(), $rpid);  
+    db_query("UPDATE {openid_provider_relying_party} SET access=%d, last_time=%d WHERE rpid=%d", $access, time(), $rpid);  
   }
   else {
-    db_query("INSERT INTO {openid_provider_relying_party} (uid, realm, first_time, last_time, auto_release) VALUES (%d, '%s', %d, %d, %d)", $uid, $realm, time(), time(), $auto_release);
+    db_query("INSERT INTO {openid_provider_relying_party} (uid, realm, first_time, last_time, access) VALUES (%d, '%s', %d, %d, %d)", $uid, $realm, time(), time(), $access);
   }
 }
 function _openid_provider_nonce() {
diff --git a/openid_provider.install b/openid_provider.install
index 2caceef..96d6a71 100644
--- a/openid_provider.install
+++ b/openid_provider.install
@@ -54,7 +54,7 @@ function openid_provider_schema() {
         'default' => 0,
         'description' => t('Timestamp of the most recent access'),
       ),
-      'auto_release' => array(
+      'access' => array(
         'type' => 'int',
         'not null' => TRUE,
         'default' => 0,
@@ -107,4 +107,12 @@ function openid_provider_schema() {
   );
 
   return $schema;
-}
\ No newline at end of file
+}
+
+function openid_provider_update_6100() {
+  $ret = array();
+  db_change_field($ret, 'openid_provider_relying_party', 'auto_release', 'access', array('type' => 'int', 'not null' => TRUE,'default' => 0));
+  /* the field changed semantics: 0 now means deny (instead of ask), 1 means ask (instead of allow) and 2 means allow, so we just bump everyone by one */
+  $ret[] = update_sql("UPDATE {openid_provider_relying_party} SET access = access + 1;");
+  return $ret;
+}
diff --git a/openid_provider.module b/openid_provider.module
index c7ddcc9..6278fe1 100644
--- a/openid_provider.module
+++ b/openid_provider.module
@@ -7,6 +7,18 @@
  */
 
 /**
+ * access control constants
+ *
+ * those are used to identify how to let the sites access this provider and
+ * are stored in the database, in the openid_provider_relying_party table.
+ *
+ * Do not assume truth or numeric value here and always use the constants.
+ */
+define('OPENID_PROVIDER_DENY', 0);
+define('OPENID_PROVIDER_ASK', 1);
+define('OPENID_PROVIDER_ALLOW', 2);
+
+/**
  * Implementation of hook_menu().
  */
 function openid_provider_menu() {
@@ -109,7 +121,7 @@ function openid_provider_user($op, &$edit, &$account, $category = NULL) {
     case 'insert':
     case 'update':
       if (module_exists('pathauto')) {
-        _pathauto_include();
+        module_load_include('inc', 'pathauto');
         // Use the username to automatically create an alias
         $pathauto_user = (object) array_merge((array) $account, $edit);
         if ($account->name) {
@@ -123,7 +135,7 @@ function openid_provider_user($op, &$edit, &$account, $category = NULL) {
       // If the user is deleted, remove the path aliases
       if (module_exists('pathauto')) {
         $account = (object) $account;
-       	path_set_alias(openid_provider_user_path($account->uid));
+         path_set_alias(openid_provider_user_path($account->uid));
       }
       break;
     case 'view':
@@ -222,7 +234,7 @@ function openid_provider_xrds($account = NULL) {
 function openid_provider_form(&$form_state, $response = array(), $realm = NULL) {
   global $user;
 
-  // Use form_state to store the $response and $realm values 
+  // Use form_state to store the $response and $realm values.
   if (count($response)) {
     $form_state['storage']['response'] = $response;
   }
@@ -248,19 +260,27 @@ function openid_provider_form(&$form_state, $response = array(), $realm = NULL)
     '#type' => 'markup',
     '#value' => '<p>'. t('You are being logged into %site, would you like to continue?', array('%site' => $realm)) .'</p>'
   );
-  $form['submit_once'] = array(
+  
+  $form['#action'] = url('openid/provider/send');
+
+  $form['submit_allow_always'] = array(
+    '#type' => 'submit',
+    '#value' => t('Yes; always'),
+    '#submit' => array('openid_provider_form_submit_allow_always')
+  );
+  $form['submit_allow_once'] = array(
     '#type' => 'submit',
     '#value' => t('Yes; just this once'),
   );
-  $form['submit_always'] = array(
+  $form['submit_deny_once'] = array(
     '#type' => 'submit',
-    '#value' => t('Yes; always'),
-    '#submit' => array('openid_provider_form_submit_always')
+    '#value' => t('No'),
+    '#submit' => array('openid_provider_form_submit_deny_once')
   );
-  $form['cancel'] = array(
+  $form['submit_always_deny'] = array(
     '#type' => 'submit',
-    '#value' => t('Cancel'),
-    '#submit' => array('openid_provider_form_submit_cancel')
+    '#value' => t('No; never allow access'),
+    '#submit' => array('openid_provider_form_submit_deny_always')
   );
 
   return $form;
@@ -269,28 +289,28 @@ function openid_provider_form(&$form_state, $response = array(), $realm = NULL)
 /**
  * Once submit handler
  */
-function openid_provider_form_submit(&$form, $form_state, $auto_release = FALSE) {
+function openid_provider_form_submit(&$form, $form_state, $access = OPENID_PROVIDER_ASK) {
   global $user;
 
   module_load_include('inc', 'openid');
   module_load_include('inc', 'openid_provider');
   
   $response = _openid_provider_sign($form_state['storage']['response']);
-  _openid_provider_rp_save($user->uid, $form_state['storage']['realm'], $auto_release);
+  _openid_provider_rp_save($user->uid, $form_state['storage']['realm'], $access);
   openid_redirect_http($response['openid.return_to'], $response);
 }
 
 /**
  * Always submit handler
  */
-function openid_provider_form_submit_always(&$form, $form_state) {
-  return openid_provider_form_submit($form, $form_state, TRUE);
+function openid_provider_form_submit_allow_always(&$form, $form_state) {
+  return openid_provider_form_submit($form, $form_state, OPENID_PROVIDER_ALLOW);
 }
  
 /**
- * Cancel submit handler
+ * Deny submit handler
  */
-function openid_provider_form_submit_cancel(&$form, $form_state) {
+function openid_provider_form_submit_deny_once(&$form, $form_state) {
   module_load_include('inc', 'openid_provider');
   module_load_include('inc', 'openid');
   
@@ -300,6 +320,14 @@ function openid_provider_form_submit_cancel(&$form, $form_state) {
 }
 
 /**
+ * Deny always submit handler
+ */
+function openid_provider_form_submit_deny_always(&$form, $form_state) {
+  _openid_provider_rp_save($user->uid, $form_state['storage']['realm'], OPENID_PROVIDER_DENY);
+  return openid_provider_form_submit($form, $form_state);
+}
+
+/**
  * Implementation of hook_pathauto() for OpenID Provider aliases.
  */
 function openid_provider_pathauto($op) {
diff --git a/openid_provider.pages.inc b/openid_provider.pages.inc
index bfb918d..9861ae6 100644
--- a/openid_provider.pages.inc
+++ b/openid_provider.pages.inc
@@ -71,7 +71,7 @@ function openid_provider_send() {
 
 /**
  * Page callback for OpenID Sites form where users can configure the
- * auto_release status of RP's they have logged into.
+ * access status of RP's they have logged into.
  *
  * @param object $account User account object for the user.
  */
@@ -97,29 +97,36 @@ function openid_provider_sites_form($form_state, $user = NULL) {
       '#description' => t('Those are the sites you have used your OpenID on. Access control determines determines if you will be asked for approval when login into those sites using your OpenID. You can also completely deny access to those sites if you think they are malicious.'),
   );
   
+  $result = pager_query("SELECT * FROM {openid_provider_relying_party} WHERE uid=%d ORDER BY last_time DESC", 50, 0, NULL, $user->uid);
+  
+  $form['description'] = array(
+    '#type' => 'item',
+    '#description' => t('Those are the sites you have used your OpenID on. Access control determines determines if you will be asked for approval when login into those sites using your OpenID. You can also completely deny access to those sites if you think they are malicious.'),
+  );
+  
   $form['submit'] = array(
-      '#type' => 'submit',
-      '#value' => t('Update'),
+    '#type' => 'submit',
+    '#value' => t('Update'),
   );
-
-  $form['auto_release']['#tree'] = TRUE;
+  
+  $form['access']['#tree'] = TRUE;
+  $access_options = array(OPENID_PROVIDER_DENY => t('Deny'), OPENID_PROVIDER_ASK => t('Ask'), OPENID_PROVIDER_ALLOW => t('Allow'));
   while ($rp = db_fetch_object($result)) {
-      $rps[$rp->rpid] = '';
-      $form['site'][$rp->rpid] = array(
-          '#value' => l($rp->realm, $rp->realm),
-      );
-      $form['last_access'][$rp->rpid] = array(
-          '#value' => $rp->last_time,
-      );
-      $form['auto_release'][$rp->rpid] = array(
-          '#type' => 'checkbox',
-          '#default_value' => $rp->auto_release,
-      );
+    $rps[$rp->rpid] = '';
+    $form['site'][$rp->rpid] = array(
+      '#value' => l($rp->realm, $rp->realm),
+    );
+    $form['last_access'][$rp->rpid] = array(
+      '#value' => $rp->last_time,
+    );
+    $form['access'][$rp->rpid] = array(
+      '#type' => 'radios',
+      '#options' => $access_options,
+      '#default_value' => $rp->access,
+    );
   }
-
   $form['pager'] = array('#value' => theme('pager', NULL, 50, 0));
   $form['#theme'] = 'openid_provider_sites';
-
   return $form;
 }
 
@@ -127,8 +134,8 @@ function openid_provider_sites_form($form_state, $user = NULL) {
  * Form submit callback for openid_provider_sites.
  */
 function openid_provider_sites_form_submit($form, &$form_state) {
-  foreach ($form_state['values']['auto_release'] as $key => $value) {
-    db_query("UPDATE {openid_provider_relying_party} SET auto_release=%d WHERE rpid=%d", $value, $key);
+  foreach ($form_state['values']['access'] as $key => $value) {
+    db_query("UPDATE {openid_provider_relying_party} SET access=%d WHERE rpid=%d", $value, $key);
   }
   drupal_set_message(t('Settings saved.'));
 }
@@ -141,10 +148,10 @@ function openid_provider_sites_form_submit($form, &$form_state) {
 function theme_openid_provider_sites($form) {
   // If there are rows in this form, then $form['title'] contains a list of
   // the title form elements.
-  $header = array(t('Auto release'), t('Site'), t('Last access'));
+  $header = array(t('Access control'), t('Site'), t('Last access'));
   foreach (element_children($form['site']) as $key) {
     $row = array();
-    $row[] = drupal_render($form['auto_release'][$key]);
+    $row[] = drupal_render($form['access'][$key]);
     $row[] = drupal_render($form['site'][$key]);
     $row[] = format_date(drupal_render(($form['last_access'][$key])));
     $rows[] = $row;
@@ -159,4 +166,4 @@ function theme_openid_provider_sites($form) {
   $output .= drupal_render($form);
 
   return $output;
-}
\ No newline at end of file
+}