Okay, I can answer the second part myself (for the record).
In searching around the 'net today I found a note saying that instead of the canonical
setenv CVS_RSH ssh
line in your .login file one should supply a complete path to ssh, as in /usr/bin/ssh. This is wrong! It must be as shown above. FYI.