In a setup where Apache handles authentication (here
sspi-auth) the user supplied by Apache is overriden by
the user identified from the cookie. This is especially
bad if it is the cookie of an administrator since the
user gets the admin-rights...

client.py had to be changed (see patch).

Regards,
David