Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path:
where encoded_data is either 811, or 726 characters long (for admins and unprivileged users respectively).
charset is [a-zA-z0-9_-] and looks like underscore/hyphen are being used to encode data rather than as separators. here are the first 80 characters from four authenticated requests:
kDXQCdyBLGeI6iffL7NCerz-2n7cqsQkAd--qu_cwaDku3u05mkOfLnhG0X0jhYj78VCulnaWX96Aaj3 O_sTfG87ndgFssFpZrQ1zIi7AXGs8ft-ufiRcs9tec0seoMnZuuvYexCmRONdhylx5mxy_QJw8qD04CM hY1YSR-1yT6Mr61HPd0sKHRsGpIHvfXCyvTreOza9hMMmROxv9RKdDY-4gb1z4IMAlGM0aaFqaCUv1VN qtFUBJtBT-6eL7Fxrj47H2ryTVe0uVLWHVxtxC-Xp0Hw2g-7gN_ovBi-e_i-iTHDAmbhNJkesk_7wxSI
Client GETs the massive path string and server responds with a new, PHPSESSID cookie value for the authenticated session. I realise length, and the /login/auth/ component of the path could be variable (user-set), but I don't know how it has been configured.