The fix for NXP-6664 is incomplete, the cookie changed is never set in NuxeoAuthenticationFilter.getSavedRequestedURL (bug since NXP-3077).
NXP-3077 Anonymous and CAS authentication should work together
NXP-6664 enforce requested URL cookie remove in SSO