session variable not being substituted?

As a second check to VPN access, I need to check the mac address of the machine against a database we have. I've set up an AAA HTTP server with a form-based http get that works when I specify an absolute value. the url I use is

http://server.full.name/infoserv/cgi-bin/computing/database/hardware/vpn/MacValid.asp?MacAddress=00:00:00:00:00:00

but when I change it to

http://server.full.name/infoserv/cgi-bin/computing/database/hardware/vpn/MacValid.asp?MacAddress=%{session.machine_info.net_adapter.list.[0].mac_address}

the session variable is NOT substituted but passed to our web server as "%{session.machine_info.net_adapter.list.[0].mac_address"

I've also tried %{session.client.mac_address} with the same result.

Is there some trick to getting session variables to work in the "form action" field?

thanks