ok. it reports malformed multipart POST (same as the logs). sniffer seems to show, that at times, the browser will send a POST with an Authentication header and no post following. At other times, there are two posts, one for Authentication and the next for the form data after the users has been verified. I took authentication off and nothing was solved.