Discrepancy in user authorization

[wxpmeonrvib]

The functoin "mod_authopenid_check_user_access" checks, if the user (as entered in the Indentity URL field) exists in the "require user A B C" directive. If, in addition to that, the user has a valid session, the module grants permission to enter. But: The "get_claimed_id" (which can defer from the actually entered, e.g. by wrapping in http://*/, or by using https://www.google.com/accounts/o8/id) will actually be used in the user program AND in Apache's Own Authorization:

mod_auth_openid will give green light but Apache will give a 401 Error! And the worst part is, that the user cannot go back, because mod_auth_openid is satisfied by the cookie and the login page will not be shown anymore!