ahhhh thanks.
one other thing:
http://myserver.com:3689/databases/1/items?output=xml&query=’daap.songartist:Lagwagon’
gives me a valid xml file with all items found.
i don’t user authorization here, so this seems to be a security issue, right?