It specifically has to be the Control-NPC, which is listed among database NPCs.
Try:
PHP Code:
function onActionPlayerOnline(){
player.removeweapon("Bow");
echo(player.account SPC "logged in");
}
in order to determine whether the function is even occurring.