owncloud/core — pull request #6922 by DamnDam (2014-01-23 18:03:45+00:00)
Title:  Override HTTP login name with session login name

from @josh4trunks owncloud#6133
>Browsers will keep sending credentials until given a 401 and told to reauthenticate. This fixes cases where a user's browser has a credential with an non-mathcing username likely set by another application running on another subdirectory

This is an alternate patch attempting to fix the same issue. This is done without prompting the user again for its browser credentials.

We stop the browser sending credentials by redirecting to `http(s)://user@his-owncloud.com`, user being the user provided by the session. We achieve exactly the same results, ie stopping the browser from sendin over bad credentials.

We do not need to reauthenticate the user, and owncloud#6133 does NOT reauthenticate either, password provided is never checked against when session is provided.