Fix issue where new cookies from the main request.response are not passed to subrequests

I've no idea, how I managed to rebase on top of master so that also Ramon's security manager addition is here

Anyway, this fixes issue with Mosaic where tiles merge had issues after successful login, because subrequest calls didn't get authentication cookie.