Finally fixed the session+redirection(+http password)(+not differentiate guest users) bug. If you have cookie that repesent a session this is sent to the user via req.headers_out. But redirection is based on raising an HTTP error, so the header that is sent is req.err_headers_out, which didn't contained the cookie. I'm now enforcing the cookie in err.headers_out and this works! It is finally safe to disable CFG_WEBSESSION_DIFFERENTIATE_BETWEEN_GUESTS and to enable the CERN hack to popup password for apache group when there's only one group related to a collection.