Trying to be smart with a fancy sequence diagram in text, I forgot to proof read the damn thing. The last redirect should be GET, not POST. Which is the essence of my problem. Any POST request are converted to GET request because the Authentication filter does redirects.