So make a page only accessible if the user is logged in. Basically it works fine but not with our specific config, because we disabled the system.session.initialize.
In that case, access to the page always shows the login mask even if changing this config after login.
Does anyone know if this behaviour is intended and if not how we may could workaround this?