I believe I was getting confused with the triggers and thought both were firing...but it is only one per request.
I am doing AJAX requests and have HTML and PHP separated...studying the auto-generated security assist pages had me confused.
I think I am good now ;-)
Thanks,
Brent