Fix that you can not login

Change spec file for apache rights on tmp directory and test
that a user is logged in before start refresh task on a
secured url action.

fixes #5107