diff --git a/default/Makefile.am b/default/Makefile.am
index 0656b3e60..bde0400c0 100644
--- a/default/Makefile.am
+++ b/default/Makefile.am
@@ -314,7 +314,6 @@ nobase_default_DATA = \
 	web_tt2/lists.tt2 \
 	web_tt2/loginbanner.tt2 \
 	web_tt2/login_menu.tt2 \
-	web_tt2/loginrequest.tt2 \
 	web_tt2/login.tt2 \
 	web_tt2/ls_templates.tt2 \
 	web_tt2/maintenance.tt2 \
diff --git a/default/mail_tt2/report.tt2 b/default/mail_tt2/report.tt2
index 781d1e7eb..c211a6acf 100644
--- a/default/mail_tt2/report.tt2
+++ b/default/mail_tt2/report.tt2
@@ -435,6 +435,9 @@
 [%~ ELSIF report_entry == 'user_notified' ~%]
   [%|loc(report_param.notified_user)%]User %1 has been notified[%END%]
 
+[%~ ELSIF report_entry == 'logout' ~%]
+  [%|loc%]You have logged out[%END%]
+
 [%~ END ~%]
 
 [%################~%]
diff --git a/default/web_tt2/including_lists.tt2 b/default/web_tt2/including_lists.tt2
index 4ab21d57c..91596237f 100644
--- a/default/web_tt2/including_lists.tt2
+++ b/default/web_tt2/including_lists.tt2
@@ -1,6 +1,6 @@
 <!-- including_lists.tt2 -->
 <h2><i class="fa fa-envelope-square"></i> [%|loc(list)%]Lists including %1[%END%]</h2>
-[% IF user.email ~%]
+
   [% IF which.size ~%]
     <p>[%|loc(list)%]Following lists are including list %1.[%END%]</p>
 
@@ -48,9 +48,4 @@
 
   [%~ END %]
 
-[%~ ELSE ~%]
-  <article>
-   [% PROCESS loginrequest.tt2 %]
-  </article>
-[%~ END %]
 <!-- end including_lists.tt2 -->
diff --git a/default/web_tt2/login.tt2 b/default/web_tt2/login.tt2
index 0ec1b3ece..c83cf0f28 100644
--- a/default/web_tt2/login.tt2
+++ b/default/web_tt2/login.tt2
@@ -1,4 +1,139 @@
 <!-- login.tt2 -->
+[% IF back_to_mom ~%]
+  <p>
+    [%|loc(user.email)%]You have logged in with email address %1[%END%]
+  </p>
+[% ELSE ~%]
 
-[%|loc(user.email)%]You have logged in with email address %1.[%END%]<br />
+<h2>
+  <i class="fa fa-user"></i>
+  [% IF use_sso && use_passwd && only_passwd ~%]
+    [%|loc%]Login locally[%END%]
+  [%~ ELSE ~%]
+    [%|loc%]Login[%END%]
+  [%~ END %]
+</h2>
+
+<p>
+  [%|loc%]In order to perform a privileged operation (one that requires your email address), you need to login.[%END%]
+</p>
+
+[% IF use_sso && !only_passwd ~%]
+  <div class="row">
+  <div class="columns">
+    <form id="use-sso" action="[% path_cgi %]" method="post">
+    <fieldset>
+    <input type="hidden" name="previous_action"
+     value="[% previous_action %]" />
+    <input type="hidden" name="previous_list" value="[% previous_list %]" />
+    <input type="hidden" name="list" value="[% list %]" />
+    <input type="hidden" name="action" value="sso_login" />
+    <input type="hidden" name="nomenu" value="[% nomenu %]" />
+    [% IF sso_number == 1 ~%]
+      [% FOREACH server = sso ~%]
+        <input type="hidden" name="auth_service_name"
+         value="[% server.key %]" />
+        <button type="submit" name="action_sso_login"
+         value="[% server.value %]">
+          <i class="fa fa-user"></i> [% server.value %]
+        </button>
+      [%~ END %]
+    [%~ ELSE ~%]
+      <label for="auth_service_name">
+        [%|loc%]To login, select your organization authentication server below:[%END%]
+      </label>
+      <select id="auth_service_name" name="auth_service_name"
+       class="submitOnChange">
+      <option value="1" selected>---[%|loc%]Click to select[%END%]---</option>
+      [% FOREACH server = sso ~%]
+        <option value="[% server.key %]">[% server.value %]</option>
+      [%~ END %]
+      </select>
+      <noscript>
+        <button type="submit" name="action_sso_login"
+         value="[%|loc%]Go[%END%]">[%|loc%]Go[%END%]</button>
+      </noscript>
+    [%~ END %]
+    </fieldset>
+    </form>
+  </div>
+  </div>
+[% END # IF use_sso && !only_passwd ~%]
+
+[% IF use_passwd && use_sso && !only_passwd ~%]
+  <hr />
+  <h3>
+    <i class="fa fa-user"></i> [%|loc%]Login locally[%END%]
+  </h3>
+[% END ~%]
+
+[% IF use_passwd ~%]
+  <form action="[% path_cgi %]" method="post">
+  <fieldset>
+  <input type="hidden" name="previous_action" value="[% previous_action %]" />
+  <input type="hidden" name="previous_list" value="[% previous_list %]" />
+  <input type="hidden" name="only_passwd" value="[% only_passwd %]" />
+  <input type="hidden" name="referer" value="[% referer %]" />
+  <input type="hidden" name="failure_referer" value="[% failure_referer %]" />
+  <input type="hidden" name="list" value="[% list %]" />
+  <input type="hidden" name="action" value="login" />
+  <input type="hidden" name="nomenu" value="[% nomenu %]" />
+  <input type="hidden" name="submit" value="submit" />
+  <div class="row">
+  <div class="columns">
+    <label for="email_login">[%|loc%]email address:[%END%]</label>
+    <input type="text" name="email" id="email_login" size="28"
+     value="[% email %]" />
+  </div>
+  </div>
+  <div class="row">
+  <div class="columns">
+    <label for="passwd" >[%|loc%]password:[%END%]</label>
+    <input type="password" name="passwd" id="passwd" size="8" />
+  </div>
+  </div>
+  <div class="row">
+  <div class="columns">
+    <span><button class="heavyWork" type="submit" name="action_login"
+     value="[%|loc%]Login[%END%]">
+      <i class="fa fa-user"></i> [%|loc%]Go[%END%]
+    </button></span>
+  </div>
+  </div>
+  </fieldset>
+  </form>
+
+  [% IF authentication_info_url || ! is_ldap_user ~%]
+    <hr />
+  [% END ~%]
+
+  [% IF authentication_info_url ~%]
+    <ul>
+    <li><a class="menuLinks" href="[%authentication_info_url%]">
+      [%|loc%]Authentication help[% END %]
+    </a></li>
+    </ul>
+  [%~ ELSIF is_ldap_user ~%]
+    [%# No guides %]
+  [%~ ELSIF email ~%]
+    <ul>
+    <li><a href="[% 'firstpasswd' | url_rel([],{email=>email}) %]">
+      [%|loc%]First login?[%END%]
+    </a></li>
+    <li><a href="[% 'renewpasswd' | url_rel([],{email=>email}) %]">
+      [%|loc%]Lost password?[%END%]
+    </a></li>
+    </ul>
+  [%~ ELSE ~%]
+    <ul>
+    <li><a href="[% 'firstpasswd' | url_rel %]">
+      [%|loc%]First login?[%END%]
+    </a></li>
+    <li><a href="[% 'renewpasswd' | url_rel %]">
+      [%|loc%]Lost password?[%END%]
+    </a></li>
+    </ul>
+  [%~ END %]
+[% END # IF use_passwd ~%]
+[% END # IF back_to_mom ~%]
 <!-- end login.tt2 -->
diff --git a/default/web_tt2/login_menu.tt2 b/default/web_tt2/login_menu.tt2
index 077aaa64c..94dd85cf0 100644
--- a/default/web_tt2/login_menu.tt2
+++ b/default/web_tt2/login_menu.tt2
@@ -6,7 +6,6 @@
     <input type="hidden" name="previous_action"
      value="[% previous_action %]" />
     <input type="hidden" name="previous_list" value="[% previous_list %]" />
-    <input type="hidden" name="referer" value="[% referer %]" />
     <input type="hidden" name="list" value="[% list %]" />
     <input type="hidden" name="action" value="sso_login" />
     [% IF sso_number == 1 ~%]
@@ -43,16 +42,16 @@
 [%~ END %]
 
 [% IF use_passwd == '1' ~%]
-  [% IF action == 'loginrequest'; SET class = 'active'; END ~%]
+  [% IF action == 'login'; SET class = 'active'; END ~%]
   <li class="[% class %]">
     <form action="[% path_cgi %]" method="POST">
     <fieldset>
     <input type="hidden" name="previous_action" value="[% action %]" />
     <input type="hidden" name="previous_list" value="[% list %]" />
     [% IF use_sso ~%]
-      <input type="hidden" name="login_method" value="use_passwd" />
+      <input type="hidden" name="only_passwd" value="1" />
     [%~ END %]
-    <span><button type="submit" name="action_loginrequest"
+    <span><button type="submit" name="action_login"
      value="[%|loc%]Login[%END%]">
       <i class="fa fa-user"></i>
       [% IF use_sso ~%]
diff --git a/default/web_tt2/loginrequest.tt2 b/default/web_tt2/loginrequest.tt2
deleted file mode 100644
index d79fa6768..000000000
--- a/default/web_tt2/loginrequest.tt2
+++ /dev/null
@@ -1,123 +0,0 @@
-<!-- loginrequest.tt2 -->
-<h2>
-  <i class="fa fa-user"></i>
-  [% UNLESS login_method == 'use_passwd' ~%]
-    [%|loc%]Login[%END%]
-  [%~ ELSE ~%]
-    [%|loc%]Login locally[%END%]
-  [%~ END %]
-</h2>
-
-<p>
-  [%|loc%]In order to perform a privileged operation (one that requires your email address), you need to login.[%END%]
-</p>
-
-[% IF use_sso && !login_method ~%]
-  <div class="row">
-  <div class="columns">
-    <form id="use-sso" action="[% path_cgi %]" method="post">
-    <fieldset>
-    <input type="hidden" name="previous_action"
-     value="[% previous_action %]" />
-    <input type="hidden" name="previous_list" value="[% previous_list %]" />
-    <input type="hidden" name="referer" value="[% referer %]" />
-    <input type="hidden" name="list" value="[% list %]" />
-    <input type="hidden" name="action" value="sso_login" />
-    [% IF sso_number == 1 ~%]
-      [% FOREACH server = sso ~%]
-        <input type="hidden" name="auth_service_name"
-         value="[% server.key %]" />
-        <button type="submit" name="action_sso_login"
-         value="[% server.value %]">
-          <i class="fa fa-user"></i> [% server.value %]
-        </button>
-      [%~ END %]
-    [%~ ELSE ~%]
-      <label for="auth_service_name">
-        [%|loc%]To login, select your organization authentication server below:[%END%]
-      </label>
-      <select id="auth_service_name" name="auth_service_name"
-       class="submitOnChange">
-      <option value="1" selected>---[%|loc%]Click to select[%END%]---</option>
-      [% FOREACH server = sso ~%]
-        <option value="[% server.key %]">[% server.value %]</option>
-      [%~ END %]
-      </select>
-      <noscript>
-        <button type="submit" name="action_sso_login"
-         value="[%|loc%]Go[%END%]">[%|loc%]Go[%END%]</button>
-      </noscript>
-    [%~ END %]
-    </fieldset>
-    </form>
-  </div>
-  </div>
-
-  [% IF use_passwd == '1' AND use_sso ~%]
-    <hr />
-  [%~ END %]
-[%~ END # IF use_sso && !login_method %]
-
-[% IF use_passwd == '1' ~%]
-  [% IF use_sso && !login_method ~%]
-    <h3>
-      <i class="fa fa-user"></i> [%|loc%]Login locally[%END%]
-    </h3>
-  [%~ END %]
-
-  <form action="[% path_cgi %]" method="post">
-  <fieldset>
-  <input type="hidden" name="previous_action" value="[% previous_action %]" />
-  <input type="hidden" name="previous_list" value="[% previous_list %]" />
-  <input type="hidden" name="referer" value="[% referer %]" />
-  <input type="hidden" name="list" value="[% list %]" />
-  <input type="hidden" name="action" value="login" />
-  <div class="row">
-  <div class="columns">
-    <label for="email_login">[%|loc%]email address:[%END%]</label>
-    <input type="text" name="email" id="email_login" size="28"
-     value="[% unauthenticated_email %]" />
-  </div>
-  </div>
-  <div class="row">
-  <div class="columns">
-    <label for="passwd" >[%|loc%]password:[%END%]</label>
-    <input type="password" name="passwd" id="passwd" size="8" />
-  </div>
-  </div>
-  <div class="row">
-  <div class="columns">
-    <span><button class="heavyWork" type="submit" name="action_login"
-     value="[%|loc%]Login[%END%]">
-      <i class="fa fa-user"></i> [%|loc%]Go[%END%]
-    </button></span>
-  </div>
-  </div>
-  </fieldset>
-  </form>
-
-  <hr />
-
-  <ul>
-  [% IF authentication_info_url ~%]
-    <li><a class="menuLinks" href="[%authentication_info_url%]">
-      [%|loc%]Authentication help[% END %]
-    </a></li>
-  [%~ ELSIF init_email ~%]
-    <li><a href="[% 'firstpasswd' | url_rel([],{email=>init_email}) %]">
-      [%|loc%]First login?[%END%]
-    </a></li>
-    <li><a href="[% 'renewpasswd' | url_rel([],{email=>init_email}) %]">
-      [%|loc%]Lost password?[%END%]
-    </a></li>
-  [%~ ELSE ~%]
-    <li><a href="[% 'firstpasswd' | url_rel %]">
-      [%|loc%]First login?[%END%]
-    </a></li>
-    <li><a href="[% 'renewpasswd' | url_rel %]">
-      [%|loc%]Lost password?[%END%]
-    </a></li>
-  [%~ END %]
-  </ul>
-[%~ END # IF user_passwd == '1' %]
-<!-- end loginrequest.tt2 -->
diff --git a/default/web_tt2/main.tt2 b/default/web_tt2/main.tt2
index eddf634de..3f8e2d7b7 100644
--- a/default/web_tt2/main.tt2
+++ b/default/web_tt2/main.tt2
@@ -28,7 +28,7 @@
    [% END -%]
 </head>
 
-<body onload="[% IF back_to_mom %] setTimeout('refresh_mom_and_die()',1000);[% END %]">
+<body[%IF back_to_mom%] class="backToMom"[%END%]>
 
 [% top_menu = 1 %]
 
@@ -39,7 +39,7 @@
 [% IF nomenu %]
       [% PROCESS error.tt2 IF errors %]
       <div class="nomenu">
-            [% PROCESS notice.tt2 IF notices %]
+            [% PROCESS notice.tt2 IF notices || last_login_epoch %]
             [% PROCESS "${action}.tt2" IF action %]
       </div>
 [% ELSE %]
@@ -77,7 +77,7 @@
     [% PROCESS nav.tt2 %]
   [%~ END %]
 
-  [% PROCESS notice.tt2 IF notices %]
+  [% PROCESS notice.tt2 IF notices || last_login_epoch %]
   [% PROCESS "${action}.tt2" IF action %]
   [% PROCESS dumpvars.tt2 IF dumpvars == 'true'%]
 
diff --git a/default/web_tt2/my.tt2 b/default/web_tt2/my.tt2
index 4432120f9..139189a94 100644
--- a/default/web_tt2/my.tt2
+++ b/default/web_tt2/my.tt2
@@ -1,6 +1,6 @@
 <!-- my.tt2 -->
   <h2><i class="fa fa-envelope-square"></i> [%|loc%]My lists[%END%]</h2>
-[% IF user.email %]
+
   <p>[%|loc%]You are subscribed to or managing the following lists.[%END%]</p>
   
   <form class="noborder" action="[% path_cgi %]" method="post" name="suspend_request">
@@ -62,9 +62,4 @@
 
   </form>
 
-[% ELSE %]
-    <article>
-     [% PROCESS loginrequest.tt2 %]
-    </article>
-[% END %]
 <!-- end my.tt2 -->
diff --git a/default/web_tt2/notice.tt2 b/default/web_tt2/notice.tt2
index a54aabe4c..dbbe9b72b 100644
--- a/default/web_tt2/notice.tt2
+++ b/default/web_tt2/notice.tt2
@@ -1,9 +1,14 @@
 <!-- notice.tt2 -->
 <div id="ephemeralMsg">
-[% IF last_login_date ~%]
+[% IF last_login_epoch ~%]
   <div  data-alert class="alert-box info radius">
-  <i class="fi-eye"></i> 
-  [%|loc(last_login_host,last_login_date)%]last login from %1 (%2)[%END%]<br/>
+  <i class="fi-eye"></i>
+  [% last_login_date = BLOCK ~%]
+    [% last_login_epoch | optdesc('unixtime') %]
+  [%~ END ~%]
+  <p>
+    [%|loc(last_login_host,last_login_date)%]last login from %1 (%2)[%END%]
+  </p>
   </div>
 [%~ END%]
 
diff --git a/default/web_tt2/renewpasswd.tt2 b/default/web_tt2/renewpasswd.tt2
index fe1d38f82..9cc40ddff 100644
--- a/default/web_tt2/renewpasswd.tt2
+++ b/default/web_tt2/renewpasswd.tt2
@@ -2,16 +2,24 @@
 
 [% SET SAFE_TO_REVEAL_EMAIL = 1 %]
 [% IF account_creation %]
-      [%|loc%]You requested an account creation on this list server.[%END%]
+  <p>[%|loc%]You requested an account creation on this list server.[%END%]</p>
 [% ELSIF login_error == 'wrong_password' %]
-      <div>[%|loc%]Unable to continue: The username / password combination provided was incorrect.[%END%]</div>
+  [%# Perhaps currently not used. ~%]
+  <h2>
+    <i class="fa fa-user"></i> [%|loc%]Login[%END%]
+  </h2>
+  <p>[%|loc%]Unable to continue: The username / password combination provided was incorrect.[%END%]</p>
       [% SET SAFE_TO_REVEAL_EMAIL = 0 %]
 [% ELSIF login_error == 'password_reset' %]
-      [%|loc%]Too many wrong passwords were submitted for this account. Your account has been blocked in order to protect you against attacks. You must renew your password in order to login.[%END%]
+  <h2>
+    <i class="fa fa-user"></i> [%|loc%]Login[%END%]
+  </h2>
+  <p>[%|loc%]Too many wrong passwords were submitted for this account. Your account has been blocked in order to protect you against attacks. You must renew your password in order to login.[%END%]</p>
 [% ELSIF login_error == 'missing_password' %]
-      [%|loc%]The password was incorrect. Please try again. Perhaps you have forgotten it?[%END%]
+  [%# Perhaps currently not used. ~%]
+  <p>[%|loc%]The password was incorrect. Please try again. Perhaps you have forgotten it?[%END%]</p>
 [% ELSIF login_error == 'ticket_sent' %]
-      [%|loc%]You will receive an email that will allow you to choose your password.[%END%]
+  <p>[%|loc%]You will receive an email that will allow you to choose your password.[%END%]</p>
 [% ELSE %]
 [% IF requestpasswd_context == 'firstpasswd' %]
       <p>[%|loc%]Please enter your email address to begin the registration process.[%END%]</p>
@@ -20,19 +28,30 @@
 [% END %]
 [% END %]
 [% IF SAFE_TO_REVEAL_EMAIL %]
-      <form class="bold_label" action="[% path_cgi %]" method="post">
-        <fieldset>
-          <input type="hidden" name="referer" value="[% referer %]" />
-          <input type="hidden" name="action" value="sendpasswd" />
+  <form class="bold_label" action="[% path_cgi %]" method="post">
+  <fieldset>
+    <input type="hidden" name="previous_action" value="[% previous_action %]" />
+    <input type="hidden" name="previous_list" value="[% previous_list %]" />
+    <input type="hidden" name="action" value="requestpasswd" />
+
+    <div class="row">
+      <div class="columns">
           <label for="email">[%|loc%]Your e-mail address:[%END%] </label>
-          <input id="email" type="text" name="email" size="20" value="[% unauthenticated_email %]" />
+          <input id="email" type="text" name="email" size="20"
+           value="[% email %]" />
+      </div>
+    </div>
+    <div class="row">
+      <div class="columns">
           <input class="MainMenuLinks" type="submit" name="action_requestpasswd"
             [% IF requestpasswd_context == 'firstpasswd' %]
               value="[%|loc%]Request first password[%END%]" />
             [% ELSE %]
               value="[%|loc%]Request new password[%END%]" />
             [% END %]
-        </fieldset>
-      </form>
+      </div>
+    </div>
+  </fieldset>
+  </form>
 [% END %]
 <!-- end renewpasswd.tt2 -->
diff --git a/default/web_tt2/sso_login.tt2 b/default/web_tt2/sso_login.tt2
index 26240210d..994a34b92 100644
--- a/default/web_tt2/sso_login.tt2
+++ b/default/web_tt2/sso_login.tt2
@@ -8,7 +8,6 @@
         <fieldset>
           <input type="hidden" name="previous_action" value="[% previous_action %]" />
           <input type="hidden" name="previous_list" value="[% previous_list %]" />
-          <input type="hidden" name="referer" value="[% referer %]" />
           <input type="hidden" name="subaction" value="validateemail" />
           <input type="hidden" name="action" value="sso_login" />
           <input type="hidden" name="nomenu" value="[% nomenu %]" />
diff --git a/default/web_tt2/user_menu.tt2 b/default/web_tt2/user_menu.tt2
index 4b0814e3d..dc9baf7b0 100644
--- a/default/web_tt2/user_menu.tt2
+++ b/default/web_tt2/user_menu.tt2
@@ -62,13 +62,6 @@
   </li>
 [%~ END %]
 
-[% IF last_login_date ~%]
-  <li><span>
-    [%|loc(last_login_host)%]last login from %1[%END%]
-    &nbsp;&nbsp; ([% last_login_date %])
-  <span></li>
-[%~ END %]
-
 <li><a href="[% 'pref' | url_rel %]">
   <i class="fa fa-cog"></i> [%|loc%]My preferences[%END%]
 </a></li>
@@ -80,11 +73,6 @@
   <form action="[% path_cgi %]" method="post">
   <fieldset>
   <input type="hidden" name="action" value="logout" />
-  [% IF referer ~%]
-    <input type="hidden" name="referer" value="[% referer %]" />
-  [%~ ELSE ~%]
-    <input type="hidden" name="previous_action" value="[% home %]" />
-  [%~ END %]
   <span><button class="MainMenuLinks" type="submit" name="action_logout"
    value="[%|loc%]Logout[%END%]">
   <i class="fa fa-power-off"></i> [%|loc%]Logout[%END%]
diff --git a/po/sympa/POTFILES.in b/po/sympa/POTFILES.in
index d31c1d93a..fd7c3d277 100644
--- a/po/sympa/POTFILES.in
+++ b/po/sympa/POTFILES.in
@@ -225,7 +225,7 @@ default/web_tt2/list_panel.tt2
 default/web_tt2/lists.tt2
 default/web_tt2/loginbanner.tt2
 default/web_tt2/login_menu.tt2
-default/web_tt2/loginrequest.tt2
+#default/web_tt2/loginrequest.tt2
 default/web_tt2/login.tt2
 default/web_tt2/ls_templates.tt2
 default/web_tt2/maintenance.tt2
diff --git a/src/cgi/wwsympa.fcgi.in b/src/cgi/wwsympa.fcgi.in
index 424b9a073..df3ee9cfa 100644
--- a/src/cgi/wwsympa.fcgi.in
+++ b/src/cgi/wwsympa.fcgi.in
@@ -156,7 +156,7 @@ our %comm = (
     'confirm_action'         => 'do_confirm_action',
     'home'                   => 'do_home',
     'logout'                 => 'do_logout',
-    'loginrequest'           => 'do_loginrequest',
+    #'loginrequest'           => 'do_loginrequest',
     'login'                  => 'do_login',
     'sso_login'              => 'do_sso_login',
     'sso_login_succeeded'    => 'do_sso_login_succeeded',
@@ -340,28 +340,19 @@ my %comm_aliases = (
     'automatic_lists_request' => 'create_automatic_list_request',
     'change_email'            => 'move_user',
     'change_email_request'    => 'move_user',
+    'del_fromsig'             => 'auth_del',
     'dump'                    => 'export_member',
     'ignoresig'               => 'decl_del',
     'ignoresub'               => 'decl_add',
-    'del_fromsig'             => 'auth_del',
+    'loginrequest'            => 'login',
     'rename_list'             => 'move_list',
     'restore_list'            => 'open_list',
     'sigrequest'              => 'signoff',
     'subrequest'              => 'subscribe',
 );
 
-my %auth_action = (
-    'logout'              => 1,
-    'loginrequest'        => 1,
-    'login'               => 1,
-    'sso_login'           => 1,
-    'sso_login_succeeded' => 1,
-    'renewpasswd'         => 1,
-    'firstpasswd'         => 1,
-    'choosepasswd'        => 1,
-    'sendssopasswd'       => 1,    #FIXME: currently not used
-    'ticket'              => 1,
-);
+# No longer used.
+#my %auth_action;
 
 # Arguments awaited in the PATH_INFO, depending on the action.
 # NOTE:
@@ -378,11 +369,11 @@ our %action_args = (
     'latest_lists'    => ['topic', 'subtopic'],
     'active_lists'    => ['topic', 'subtopic'],
     'including_lists' => ['list'],
-    'login' => ['email', 'passwd', 'previous_action', 'previous_list'],
+    'login' => ['previous_action', 'previous_list'],
     'sso_login' => ['auth_service_name', 'subaction', 'email', 'ticket'],
     'sso_login_succeeded' =>
         ['auth_service_name', 'previous_action', 'previous_list'],
-    'loginrequest' => ['previous_action', 'previous_list'],
+    #'loginrequest' => ['previous_action', 'previous_list'],
     'logout'       => ['previous_action', 'previous_list'],
     'renewpasswd'  => ['previous_action', 'previous_list'],
     'firstpasswd'  => ['previous_action', 'previous_list'],
@@ -584,6 +575,7 @@ our %required_args = (
     'load_cert'     => ['param.list'],
     'logout'        => ['param.user.email'],
     'manage_template' => ['param.list', 'param.user.email'],
+    'my'              => ['param.user.email'],
     'rt_create' => ['param.list', 'param.user.email', 'new_template_name'],
     'rt_delete'     => ['param.list', 'param.user.email', 'message_template'],
     'rt_edit'       => ['param.list', 'param.user.email', 'message_template'],
@@ -622,7 +614,7 @@ our %required_args = (
     'tracking'        => ['param.list'],
     'requestpasswd'   => ['email'],
     'serveradmin'     => ['param.user.email'],
-    'set'      => ['param.list', 'reception|visibility'],
+    'set'      => ['param.user.email', 'param.list', 'reception|visibility'],
     'set_lang' => [],
     'set_pending_list_request' => ['param.user.email'],
     'setpasswd' => ['param.user.email', 'newpasswd1', 'newpasswd2'],
@@ -1281,9 +1273,8 @@ while ($query = CGI::Fast->new) {
     $param->{'session'} = $session->as_hashref();
 
     $log->{level} = $session->{'log_level'} if ($session->{'log_level'});
-    $param->{'restore_email'}         = $session->{'restore_email'};
-    $param->{'dumpvars'}              = $session->{'dumpvars'};
-    $param->{'unauthenticated_email'} = $session->{'unauthenticated_email'};
+    $param->{'restore_email'} = $session->{'restore_email'};
+    $param->{'dumpvars'}      = $session->{'dumpvars'};
 
     ## RSS does not require user authentication
     unless ($rss) {
@@ -1447,17 +1438,7 @@ while ($query = CGI::Fast->new) {
             }
         }
 
-        ##Cookie extern : sympa_altemails
-        ## !!
-        $param->{'alt_emails'} =
-            Sympa::WWW::Session::check_cookie_extern($ENV{'HTTP_COOKIE'},
-            $Conf::Conf{'cookie'}, $param->{'user'}{'email'});
-
         if ($param->{'user'}{'email'}) {
-            #$param->{'auth'} =
-            #    $param->{'alt_emails'}{$param->{'user'}{'email'}}
-            #    || 'classic';
-
             if (Sympa::User::is_global_user($param->{'user'}{'email'})) {
                 $param->{'user'} =
                     Sympa::User::get_global_user($param->{'user'}{'email'});
@@ -1635,6 +1616,35 @@ while ($query = CGI::Fast->new) {
         $param->{'title_clear_txt'} = $param->{'title'};
     }
 
+    $param->{'is_user_allowed_to'} = sub {
+        my $permission = shift;
+        my $list       = shift;
+        return 0 unless $permission and $list;
+
+        $list = Sympa::List->new($list, $robot)
+            unless ref $list eq 'Sympa::List';
+        my $result = Sympa::Scenario::request_action(
+            $list,
+            $permission,
+            $param->{'auth_method'},
+            {   'sender'      => $param->{'user'}{'email'},
+                'remote_host' => $param->{'remote_host'},
+                'remote_addr' => $param->{'remote_addr'}
+            }
+        );
+
+        return 0
+            unless ref($result) eq 'HASH'
+            and $result->{'action'} ne 'reject';
+        return 0
+            if $permission eq 'subscribe'
+            and $list->is_list_member($param->{'user'}{'email'});
+        return 0
+            if $permission eq 'archive.web_access'
+            and not defined $list->{'admin'}{'archive'};
+        return 1;
+    };
+
     # Store oauth_token in session if present and no user so that it
     # will not be lost during login process
     my $oauth_token = $in{'oauth_token'} || '';
@@ -1644,97 +1654,21 @@ while ($query = CGI::Fast->new) {
     ## store in session table this session contexte
     $session->store();
 
-    ## Do not manage cookies at this level if content was already sent
+    # Do not manage cookies at this level if content was already sent.
     unless (
-        $param->{'bypass'} eq 'extreme'
-        #XXX|| $param->{'action'} eq 'css'
-        || $maintenance_mode
-        || $rss || $ajax
-        ) {
+        $param->{'bypass'} eq 'extreme' or $maintenance_mode or $rss or $ajax
+    ) {
+        $session->renew unless $param->{'use_ssl'};
 
-        my $delay = $param->{'user'}{'cookie_delay'};
-        unless (defined $delay) {
-            $delay = $Conf::Conf{'cookie_expire'};
-        }
-
-        if ($delay == 0) {
-            $delay = 'session';
-        }
-        $session->renew() unless $param->{'use_ssl'};
-
-        unless (
-            $session->set_cookie(
-                $param->{'cookie_domain'},
-                $delay, $param->{'use_ssl'}
-            )
-            ) {
-            wwslog('notice', 'Could not set HTTP cookie');
-        }
-
-        $param->{'is_user_allowed_to'} = sub {
-            my $permission = shift;
-            my $list       = shift;
-
-            return 0 unless $permission and $list;
-
-            $list = Sympa::List->new($list, $robot)
-                unless ref $list eq 'Sympa::List';
-
-            my $result = Sympa::Scenario::request_action(
-                $list,
-                $permission,
-                $param->{'auth_method'},
-                {   'sender'      => $param->{'user'}{'email'},
-                    'remote_host' => $param->{'remote_host'},
-                    'remote_addr' => $param->{'remote_addr'}
-                }
-            );
-
-            return 0
-                unless ref($result) eq 'HASH'
-                and $result->{'action'} ne 'reject';
-
-            return 0
-                if $permission eq 'subscribe'
-                and $list->is_list_member($param->{'user'}{'email'});
-
-            return 0
-                if $permission eq 'archive.web_access'
-                and not defined $list->{'admin'}{'archive'};
-
-            return 1;
-        };
+        $session->set_cookie($param->{'cookie_domain'},
+            $param->{'user'}{'cookie_delay'}, $param->{'use_ssl'});
+        # Set/delete cookie for alt_emails.
+        $session->set_cookie_extern($param->{'cookie_domain'},
+            $param->{'use_ssl'});
 
-        # Set cookies unless client use https authentication
         if ($param->{'user'}{'email'}) {
-            if ($param->{'user'}{'email'} ne 'x509') {    #FIXME FIXME FIXME
-                $session->{'auth'} ||= 'classic';
-                $param->{'cookie_set'} = 1;
-
-                ###Cookie extern : sympa_altemails
-                my $number = 0;
-                foreach my $element (keys %{$param->{'alt_emails'}}) {
-                    $number++ if ($element);
-                }
-
-                unless ($number == 0) {
-                    unless (
-                        Sympa::WWW::Session::set_cookie_extern(
-                            $Conf::Conf{'cookie'},
-                            $param->{'cookie_domain'},
-                            %{$param->{'alt_emails'}}
-                        )
-                        ) {
-                        wwslog('notice',
-                            'Could not set HTTP cookie for external_auth');
-                    }
-                }
-            }
+            $session->{'auth'} ||= 'classic';
         }
-        # elsif ($ENV{'HTTP_COOKIE'} =~ /sympauser\=/) {
-        #     cookielib::set_cookie('unknown', $Conf::Conf{'cookie'},
-        #         $param->{'cookie_domain'}, 'now');
-        # }
     }
 
     ## Available languages
@@ -1932,19 +1866,6 @@ sub wwslog {
     $wwsmsg = "[list $param->{'list'}] " . $wwsmsg
         if $param->{'list'};
 
-    if ($param->{'alt_emails'}) {
-        my @alts;
-        foreach my $alt (keys %{$param->{'alt_emails'}}) {
-            push @alts, $alt
-                unless ($alt eq $param->{'user'}{'email'});
-        }
-
-        if ($#alts >= 0) {
-            my $alt_list = join ',', @alts;
-            $wwsmsg = "[alt $alt_list] " . $wwsmsg;
-        }
-    }
-
     $wwsmsg = "[user $param->{'user'}{'email'}] " . $wwsmsg
         if $param->{'user'}{'email'};
 
@@ -2316,15 +2237,15 @@ sub check_action_parameters {
 
                 ## User is not authenticated
             } elsif ($arg_name eq 'param.user.email') {
-                unless (defined $param->{'user'} && $param->{'user'}{'email'})
-                {
+                unless ($param->{'user'} and $param->{'user'}{'email'}) {
                     if (prevent_visibility_bypass()) {
                         Sympa::WWW::Report::reject_report_web('user',
                             'authorization_reject', {}, $param->{'action'},
                             '');
+                    } else {
+                        Sympa::WWW::Report::reject_report_web('user',
+                            'no_user', {}, $action);
                     }
-                    Sympa::WWW::Report::reject_report_web('user', 'no_user', {},
-                        $action);
                     wwslog('err', 'User not logged in');
                     web_db_log(
                         {   'status'     => 'error',
@@ -2332,12 +2253,11 @@ sub check_action_parameters {
                         }
                     );
 
-                    ## User is redirected to the login request form
-                    $param->{'previous_action'} = $action;
-                    $param->{'previous_list'}   = $param->{'list'}
-                        if (defined $param->{'list'});
-                    return 'loginrequest';
-
+                    # User is redirected to the login request form.
+                    # Once logged in, they will be redirected to the URL in
+                    # $session->{'redirect_url'}.
+                    delete $in{'submit'};    # Clear it.
+                    return 'login';
                 }
                 ## Other incoming parameters
             } else {
@@ -2582,6 +2502,10 @@ sub prepare_report_user {
 sub check_param_in {
     wwslog('debug2', '');
 
+    # Restore last login info if any: See do_login() & do_sso_login().
+    $param->{'last_login_epoch'} = delete $session->{'last_login_date'};
+    $param->{'last_login_host'}  = delete $session->{'last_login_host'};
+
     # listmaster has owner and editor privileges for the list.
     if (Sympa::is_listmaster($robot, $param->{'user'}{'email'})) {
         $param->{'is_listmaster'} = 1;
@@ -2925,19 +2849,6 @@ sub check_param_out {
                 && $param->{'is_owner'}) {
                 $param->{'may_sync'} = 1;
             }
-        } else {
-            ## If user not logged in && GET method && not an authN-related
-            ## action
-            ## Keep track of the 'referer' parameter
-            if ($ENV{'REQUEST_METHOD'} eq 'GET'
-                and not $auth_action{$in{'action'}}) {
-                $param->{'referer'} =
-                    Sympa::Tools::Text::escape_chars(
-                    Sympa::WWW::Tools::get_my_url($robot));
-            } else {
-                ## Keep the previous value of the referer
-                $param->{'referer'} = $in{'referer'};
-            }
         }
 
         ## Should Not be used anymore ##
@@ -3127,11 +3038,9 @@ sub do_ticket {
         $session->{'email'} = lc($param->{'ticket_context'}{'email'});
         $param->{'user'} = Sympa::User::get_global_user($session->{'email'});
         $param->{'user'}{'email'} = $session->{'email'};
-        $param->{'last_login_host'} = $param->{'user'}{'last_login_host'};
-        $param->{'last_login_date'} =
-            $language->gettext_strftime("%d %b %Y at %H:%M:%S",
-            localtime($param->{'user'}{'last_login_date'}))
-            if ($param->{'user'}{'last_login_date'});
+        # Save and update last login info.
+        $session->{'last_login_host'} = $param->{'user'}{'last_login_host'};
+        $session->{'last_login_date'} = $param->{'user'}{'last_login_date'};
         Sympa::User::update_global_user($param->{'user'}{'email'},
             {last_login_date => time(), last_login_host => $ip});
     } elsif ($param->{'ticket_context'}{'result'} eq 'closed') {
@@ -3152,30 +3061,30 @@ sub do_ticket {
 
 }
 
-## Login WWSympa
+# Login WWSympa
 sub do_login {
     wwslog('info', '(%s)', $in{'email'});
-    my $user;
-    my $next_action;
 
-    my $url_redirect;
-    if ($url_redirect = _clean_referer($in{'referer'})) {
-        $param->{'redirect_to'} = $url_redirect;
-    } elsif ($in{'previous_action'}
-        && $in{'previous_action'} !~ /^(login|logout|loginrequest)$/) {
-        $next_action = $in{'previous_action'};
-        $in{'list'} = $in{'previous_list'};
-    } else {
-        $next_action = Conf::get_robot_conf($robot, 'default_home');
-    }
-    # never return to login or logout when login.
-    $next_action = Conf::get_robot_conf($robot, 'default_home')
-        if $in{'next_action'} =~ /^(login|logout)$/;
+    my $email  = Sympa::Tools::Text::canonic_email($in{'email'});
+    my $passwd = delete $in{'passwd'};                             # Clear it.
+
+    my $previous_action = $in{'previous_action'}
+        if $in{'previous_action'}
+        and $in{'previous_action'} =~ /\A\w+\z/;
+    my $listname_re   = Sympa::Regexps::listname();
+    my $previous_list = $in{'previous_list'}
+        if $in{'previous_list'}
+        and $in{'previous_list'} =~ /\A$listname_re\z/;
+    my $only_passwd = $in{'only_passwd'};
+    $only_passwd ||= $in{'login_method'};                  # Compat. <= 6.2.36
+    my $success_referer = _clean_referer($in{'referer'});
+    my $failure_referer = _clean_referer($in{'failure_referer'});
+    my $ldap_auth_info  = is_ldap_user($email);
 
     if ($param->{'user'}{'email'}) {
         Sympa::WWW::Report::reject_report_web('user', 'already_login',
             {'email' => $param->{'user'}{'email'}},
-            $param->{'action'}, '');
+            $param->{'action'});
         wwslog('info', 'User %s already logged in',
             $param->{'user'}{'email'});
         web_db_log(
@@ -3185,17 +3094,29 @@ sub do_login {
                 'error_type'   => 'already_login'
             }
         );
-        if ($param->{'nomenu'}) {
-            $param->{'back_to_mom'} = 1;
-            return 1;
-        } else {
-            return $next_action;
-        }
+        return _do_login_exit($success_referer, $previous_action,
+            $previous_list);
     }
 
-    unless ($in{'email'}) {
+    $param->{'email'}                 = $email;
+    $param->{'previous_action'}       = $previous_action;
+    $param->{'previous_list'}         = $previous_list;
+    $param->{'only_passwd'}           = $only_passwd;
+    $param->{'referer'}               = $success_referer;
+    $param->{'failure_referer'}       = $failure_referer;
+    $param->{'is_ldap_user'}          = ($ldap_auth_info ? 1 : 0);
+
+    $param->{'unauthenticated_email'} = $email;            # Compat. <= 6.2.36
+    $param->{'init_email'}            = $email;            # Compat. <= 6.2.36
+
+    # Show form if not yet submitted.
+    return 1 unless delete $in{'submit'};                  # Clear it.
+    # Show form if HTTP POST method not used.
+    return 1 unless $ENV{'REQUEST_METHOD'} eq 'POST';
+
+    unless ($email) {
         Sympa::WWW::Report::reject_report_web('user', 'no_email', {},
-            $param->{'action'}, '');
+            $param->{'action'});
         wwslog('info', 'No email');
         web_db_log(
             {   'parameters'   => $in{'email'},
@@ -3204,61 +3125,27 @@ sub do_login {
                 'error_type'   => "no_email"
             }
         );
-        return $in{'previous_action'}
-            || Conf::get_robot_conf($robot, 'default_home');
-    }
-
-    $session->{'unauthenticated_email'} = $param->{'unauthenticated_email'} =
-        $in{'email'};
-
-    unless ($in{'passwd'}) {
-        my $url_redirect;
-        #Does the email belongs to an ldap directory?
-        if ($url_redirect = is_ldap_user($in{'email'})) {
-            $param->{'redirect_to'} = $url_redirect
-                if $url_redirect ne 'none';
-        } elsif ($url_redirect = _clean_referer($in{'failure_referer'})) {
-            $param->{'redirect_to'} = $url_redirect;
-        } else {
-            $in{'init_email'} = $in{'email'};
-            $param->{'init_email'} = $in{'email'};
-
-            Sympa::WWW::Report::reject_report_web('user', 'missing_arg',
-                {'argument' => 'passwd'},
-                $param->{'action'}, '');
-            wwslog('info', 'Missing parameter passwd');
-            web_db_log(
-                {   'parameters'   => $in{'email'},
-                    'target_email' => $in{'email'},
-                    'status'       => 'error',
-                    'error_type'   => "missing_parameter"
-                }
-            );
-            $param->{'login_error'} = 'missing_password';
-            return $in{'previous_action'} || 'renewpasswd';
-        }
+        return 1;
     }
 
-    my $data;
-
-    unless ($ENV{'REQUEST_METHOD'} eq 'POST') {
-        $log->syslog(
-            'notice',
-            "Authentication failed, because do not use HTTP method POST but %s",
-            $ENV{'REQUEST_METHOD'}
-        );
+    unless ($passwd) {
+        Sympa::WWW::Report::reject_report_web('user', 'missing_arg',
+            {'argument' => 'passwd'},
+            $param->{'action'});
+        wwslog('info', 'Missing parameter passwd');
         web_db_log(
             {   'parameters'   => $in{'email'},
                 'target_email' => $in{'email'},
                 'status'       => 'error',
-                'error_type'   => 'not_using_post'
+                'error_type'   => "missing_parameter"
             }
         );
-        return 'loginrequest';
+        return 1;
     }
 
-    unless ($data =
-        Sympa::WWW::Auth::check_auth($robot, $in{'email'}, $in{'passwd'})) {
+    my $data;
+
+    unless ($data = Sympa::WWW::Auth::check_auth($robot, $email, $passwd)) {
         $log->syslog('notice', 'Authentication failed');
         web_db_log(
             {   'parameters'   => $in{'email'},
@@ -3267,36 +3154,29 @@ sub do_login {
                 'error_type'   => 'authentication'
             }
         );
-        my $unauthenticated_user = Sympa::User::get_global_user($in{'email'});
-        if ($unauthenticated_user->{'wrong_login_count'} >
+        my $u = Sympa::User::get_global_user($email);
+        if (    $u
+            and $u->{'wrong_login_count'}
+            and $u->{'wrong_login_count'} >
             Conf::get_robot_conf($robot, 'max_wrong_password')) {
             $param->{'login_error'} = 'password_reset';
+            return _do_login_exit($failure_referer || $ldap_auth_info,
+                'renewpasswd');
         } else {
-            $param->{'login_error'} = 'wrong_password';
+            #$param->{'login_error'} = 'wrong_password';
+            return _do_login_exit($failure_referer, 1);
         }
 
-        my $url_redirect;
-        if ($in{'previous_action'}) {
-            delete $in{'passwd'};
-            $in{'list'} = $in{'previous_list'};
-            return $in{'previous_action'};
-        } elsif ($url_redirect = _clean_referer($in{'failure_referer'})) {
-            $param->{'redirect_to'} = $url_redirect;
-        } else {
-            return 'renewpasswd';
-        }
     }
-    $param->{'user'}            = $data->{'user'};
-    $param->{'last_login_host'} = $data->{'user'}{'last_login_host'};
-    $param->{'last_login_date'} =
-        $language->gettext_strftime("%d %b %Y at %H:%M:%S",
-        localtime($data->{'user'}{'last_login_date'}))
-        if ($data->{'user'}{'last_login_date'});
-    $session->{'auth'} = $data->{'auth'};
-    my $email = lc($param->{'user'}{'email'});
-    $session->{'email'}                 = $email;
-    $session->{'unauthenticated_email'} = '';
 
+    $param->{'user'}    = $data->{'user'};
+    $session->{'auth'}  = $data->{'auth'};
+    $session->{'email'} = $email =
+        Sympa::Tools::Text::canonic_email($param->{'user'}{'email'});
+
+    # Save and update information of last login.
+    $session->{'last_login_host'} = $param->{'user'}{'last_login_host'};
+    $session->{'last_login_date'} = $param->{'user'}{'last_login_date'};
     Sympa::User::update_global_user(
         $param->{'user'}{'email'},
         {   last_login_date   => time(),
@@ -3305,37 +3185,13 @@ sub do_login {
         }
     );
 
-    ## Set alt_email
-    if ($data->{'alt_emails'}) {
-        foreach my $k (keys %{$data->{'alt_emails'}}) {
-            $param->{'alt_emails'}{$k} = $data->{'alt_emails'}{$k};
-        }
-    }
-
-    unless ($param->{'alt_emails'}{$email}) {
-        unless (
-            Sympa::WWW::Session::set_cookie_extern(
-                $Conf::Conf{'cookie'}, $param->{'cookie_domain'},
-                %{$param->{'alt_emails'}}
-            )
-            ) {
-            wwslog('notice', 'Could not set HTTP cookie for external_auth');
-            web_db_log(
-                {   'parameters' => $param->{'cookie_domain'} . ','
-                        . join(',',
-                        map {"$_ => $param->{'alt_emails'}{$_}"}
-                            keys %{$param->{'alt_emails'} || {}}),
-                    'target_email' => $in{'email'},
-                    'status'       => 'error',
-                    'error_type'   => 'cookie'
-                }
-            );
-            return undef;
-        }
-    }
-
-    ## Current authentication mode
-    #$param->{'auth'} = $param->{'alt_emails'}{$param->{'user'}{'email'}} || 'classic';
+    # Save alt_emails in session store.
+    my $alt_emails = $data->{'alt_emails'};
+    $session->{'alt_emails'} =
+        join ',', map { sprintf '%s:%s', $_, $alt_emails->{$_} }
+        sort keys %{$alt_emails || {}};
+    wwslog('info', 'alternative emails = %s', $session->{'alt_emails'})
+        if $session->{'alt_emails'};
 
     if ($session->{'lang'}) {
         # user did choose a specific language before being logged.  Apply it
@@ -3348,8 +3204,7 @@ sub do_login {
         # user did not choose a specific language, apply user pref for this
         # session.
         my $lang_context = (ref $list eq 'Sympa::List') ? $list : $robot;
-        $param->{'lang'} =
-            $language->set_lang($user->{'lang'},
+        $param->{'lang'} = $language->set_lang($param->{'user'}{'lang'},
             Sympa::best_language($lang_context));
         $session->{'lang'} = $param->{'lang'};
     }
@@ -3380,17 +3235,6 @@ sub do_login {
         );
     }
 
-    if ($in{'newpasswd1'} && $in{'newpasswd2'}) {
-        my $old_action = $param->{'action'};
-        $param->{'action'} = 'setpasswd';
-        do_setpasswd();
-        $param->{'action'} = $old_action;
-    }
-
-    if ($param->{'nomenu'}) {
-        $param->{'back_to_mom'} = 1;
-        return 1;
-    }
     web_db_log(
         {   'parameters'   => $in{'email'},
             'target_email' => $in{'email'},
@@ -3400,14 +3244,30 @@ sub do_login {
 
     web_db_stat_log();
 
-    _redirect(
-        $session->{'redirect_url'} || Sympa::get_url(
-            $robot, undef,
-            nomenu    => $param->{'nomenu'},
-            authority => 'local'
-        )
-    );
-    return 1;
+    return _do_login_exit($success_referer, $previous_action, $previous_list);
+}
+
+sub _do_login_exit {
+    my $referer  = shift;
+    my $action   = shift;
+    my $listname = shift;
+
+    if ($param->{'nomenu'}) {
+        $param->{'back_to_mom'} = 1;
+        return 1;
+    } elsif ($referer and $referer =~ m{\Ahttps?://}i) {
+        $param->{'redirect_to'} = $referer;
+        return 1;
+    } elsif ($action
+        and not $temporary_actions{$action}
+        and not($action eq 'referer')) {                   # Compat. <= 6.2.36
+        $in{'list'} = $listname;
+        return $action;
+    } else {
+        $param->{'redirect_to'} = $session->{'redirect_url'}
+            || Sympa::get_url($robot, undef, authority => 'local');
+        return 1;
+    }
 }
 
 sub _clean_referer {
@@ -4016,36 +3876,8 @@ sub is_ldap_user {
 }
 
 ## send back login form
-sub do_loginrequest {
-    wwslog('info', '(%s, %s, %s)', $in{'previous_action'}, $in{'previous_list'}, $in{'login_method'});
-
-    if ($param->{'user'}{'email'}) {
-        Sympa::WWW::Report::reject_report_web('user', 'already_login',
-            {'email' => $param->{'user'}{'email'}},
-            $param->{'action'});
-        wwslog('info', 'Already logged in as %s', $param->{'user'}{'email'});
-        return undef;
-    }
-
-    if ($in{'init_email'}) {
-        $param->{'init_email'} = $in{'init_email'};
-    }
-
-    if ($in{'previous_action'} eq 'referer') {
-        $param->{'referer'} =
-            Sympa::Tools::Text::escape_chars($ENV{'HTTP_REFERER'});
-    } elsif (!$param->{'previous_action'}) {
-        $param->{'previous_action'} = 'loginrequest';
-    }
-
-    $param->{'title'} = 'Login'
-        if ($param->{'nomenu'});
-
-    $param->{'login_method'} = $in{'login_method'}
-        if $in{'login_method'};
-
-    return 1;
-}
+# No longer used.
+#sub do_loginrequest;
 
 ## Help / about WWSympa
 sub do_help {
@@ -4080,70 +3912,52 @@ sub do_redirect {
 sub _redirect {
     my $redirect_to = shift;
 
-    $session->set_cookie($param->{'cookie_domain'}, 'session');
+    $session->set_cookie($param->{'cookie_domain'}, 'session',
+        $param->{'use_ssl'});
     print "Status: 302 Moved\n";
     print "Location: $redirect_to\n\n";
     $param->{'bypass'} = 'extreme';
     return 1;
 }
 
-## Logout from WWSympa
+# Logout from WWSympa
 sub do_logout {
     wwslog('info', '(%s)', $param->{'user'}{'email'});
 
     delete $param->{'user'};
     $session->{'email'} = 'nobody';
+    delete $session->{'alt_emails'};
 
-    # no reason to alter the lang because user perform logout
-    # $param->{'lang'} = $param->{'cookie_lang'} =
-    #     cookielib::check_lang_cookie($ENV{'HTTP_COOKIE'})
-    #     || $list->{'admin'}{'lang'}
-    #     || Conf::get_robot_conf($robot, 'lang');
-
-    if (defined $session->{'cas_server'}
-        && (defined $Conf::Conf{'auth_services'}{$robot}
-            [$session->{'cas_server'}])
-        ) {
-        # this user was logged using CAS
+    if ($session->{'cas_server'}
+        and $Conf::Conf{'auth_services'}{$robot}[$session->{'cas_server'}]) {
+        # This user was logged using CAS.
         my $cas_server =
             $Conf::Conf{'auth_services'}{$robot}[$session->{'cas_server'}]
             {'cas_server'};
         delete $session->{'cas_server'};
 
-        my $return_url = Sympa::WWW::Tools::get_my_url($robot);
-        $return_url =~ s{/logout\b}{};
-        my $redirect_url =
-            $cas_server->getServerLogoutURL($return_url);
-        $in{'action'} = 'redirect';                     #FIXME
-        $param->{'redirect_to'} = $redirect_url;
-        return 'redirect';
+        $param->{'redirect_to'} =
+            $cas_server->getServerLogoutURL(Sympa::get_url($robot));
+        return 1;
     } elsif (defined $session->{'sso_id'}) {
-        # this user was logged using a generic_sso
-
-        ## Check if logout_url is known for this SSO
-        my $sso;
-        unless (
-            $sso = Conf::get_sso_by_id(
-                robot      => $robot,
-                service_id => $session->{'sso_id'}
-            )
-            ) {
+        # This user was logged using a generic_sso.
 
+        my $sso = Conf::get_sso_by_id(robot => $robot,
+            service_id => $session->{'sso_id'});
+        unless ($sso) {
             wwslog('err', 'Unknown SSO service_id "%s"',
                 $session->{'sso_id'});
             return undef;
         }
-
-        ## Remove sso_id
         delete $session->{'sso_id'};
 
         if ($sso->{logout_url}) {
-            $in{'action'} = 'redirect';                         #FIXME
-            $param->{'redirect_to'} = $sso->{'logout_url'};
-            return 'redirect';
+            $param->{'redirect_to'} = $sso->{logout_url};
+            return 1;
         }
     }
 
+    Sympa::WWW::Report::notice_report_web('logout', {}, $param->{'action'});
     wwslog('info', 'Logout performed');
     web_db_log(
         {   'parameters'   => $param->{'user'}{'email'},
@@ -4154,11 +3968,6 @@ sub do_logout {
 
     web_db_stat_log();
 
-    if ($in{'previous_action'} eq 'referer') {
-        $param->{'referer'} =
-            Sympa::Tools::Text::escape_chars($in{'previous_list'});
-    }
-
     return Conf::get_robot_conf($robot, 'default_home');
 }
 
@@ -4293,10 +4102,6 @@ sub do_renewpasswd {
         }
     );
 
-    if ($in{'previous_action'} eq 'referer') {
-        $param->{'referer'} =
-            Sympa::Tools::Text::escape_chars($in{'previous_list'});
-    }
     return 1;
 }
 
@@ -5406,11 +5211,10 @@ sub do_choosepasswd {
                     'error_type'   => 'no_user'
                 }
             );
-            $param->{'previous_action'} = 'choosepasswd';
-            return 'loginrequest';
         }
 
         $in{'previous_action'} = 'choosepasswd';
+        delete $in{'submit'};    # Clear it.
         return 'login';
     }
     web_db_log(
@@ -5461,18 +5265,6 @@ sub do_set {
 
         $email = $in{'email'};
     } else {
-        unless ($param->{'user'}{'email'}) {
-            Sympa::WWW::Report::reject_report_web('user', 'no_user', {},
-                $param->{'action'});
-            wwslog('info', 'No user');
-            web_db_log(
-                {   'parameters' => "$in{'reception'},$in{'visibility'}",
-                    'status'     => 'error',
-                    'error_type' => 'no_user'
-                }
-            );
-            return 'loginrequest';
-        }
         $email = $param->{'user'}{'email'};
     }
 
diff --git a/src/lib/Sympa/DatabaseDescription.pm b/src/lib/Sympa/DatabaseDescription.pm
index 02c095167..9af37654b 100644
--- a/src/lib/Sympa/DatabaseDescription.pm
+++ b/src/lib/Sympa/DatabaseDescription.pm
@@ -1273,7 +1273,11 @@ Keyword with length up to 20 o.
 
 =item text
 
-Text with length up to 500 o.
+Text with length up to 2000 o at minimum.
+4000 o or longer is recommended.
+
+Note:
+On Sympa 6.2.36 or later, required size was 500 o.
 
 =item longtext
 
diff --git a/src/lib/Sympa/DatabaseDriver/ODBC.pm b/src/lib/Sympa/DatabaseDriver/ODBC.pm
index eb81c434c..5759cc34b 100644
--- a/src/lib/Sympa/DatabaseDriver/ODBC.pm
+++ b/src/lib/Sympa/DatabaseDriver/ODBC.pm
@@ -53,7 +53,7 @@ sub translate_type {
     # ODBC
     $type =~ s/^double/real/g;
     $type =~ s/^enum.*/varchar(20)/g;
-    $type =~ s/^text.*/varchar(500)/g;
+    $type =~ s/^text.*/varchar(4000)/g; # varchar(500) on <= 6.2.36
     $type =~ s/^longtext.*/text/g;
     $type =~ s/^datetime/timestamp/g;
     $type =~ s/^mediumblob/longvarbinary/g;
diff --git a/src/lib/Sympa/DatabaseDriver/Oracle.pm b/src/lib/Sympa/DatabaseDriver/Oracle.pm
index d9c7d65ae..ffec10694 100644
--- a/src/lib/Sympa/DatabaseDriver/Oracle.pm
+++ b/src/lib/Sympa/DatabaseDriver/Oracle.pm
@@ -535,7 +535,9 @@ sub translate_type {
     $type =~ s/^tinyint.*/number/g;
     $type =~ s/^double/number/g;
     $type =~ s/^enum.*/varchar2(20)/g;
-    $type =~ s/^text.*/varchar2(500)/g;
+    # varchar2(500) on <= 6.2.36
+    # FIXME: Oracle 8 and later support varchar2 up to 4000 o.
+    $type =~ s/^text.*/varchar2(2000)/g;
     $type =~ s/^longtext.*/long/g;
     $type =~ s/^datetime.*/date/g;
     $type =~ s/^mediumblob/blob/g;
diff --git a/src/lib/Sympa/DatabaseDriver/PostgreSQL.pm b/src/lib/Sympa/DatabaseDriver/PostgreSQL.pm
index c1867f486..255a79a94 100644
--- a/src/lib/Sympa/DatabaseDriver/PostgreSQL.pm
+++ b/src/lib/Sympa/DatabaseDriver/PostgreSQL.pm
@@ -639,7 +639,7 @@ sub translate_type {
     $type =~ s/^tinyint\(.*\)/int2/g;
     $type =~ s/^bigint.*/int8/g;
     $type =~ s/^double/float8/g;
-    $type =~ s/^text.*/varchar(500)/g;
+    $type =~ s/^text.*/text/g;  # varchar(500) on <= 6.2.36
     $type =~ s/^longtext.*/text/g;
     $type =~ s/^datetime.*/timestamptz/g;
     $type =~ s/^enum.*/varchar(15)/g;
diff --git a/src/lib/Sympa/WWW/Session.pm b/src/lib/Sympa/WWW/Session.pm
index c2ecca3d1..46ee52e2b 100644
--- a/src/lib/Sympa/WWW/Session.pm
+++ b/src/lib/Sympa/WWW/Session.pm
@@ -8,6 +8,9 @@
 # Copyright (c) 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
 # 2006, 2007, 2008, 2009, 2010, 2011 Comite Reseau des Universites
 # Copyright (c) 2011, 2012, 2013, 2014, 2015, 2016, 2017 GIP RENATER
+# Copyright 2018 The Sympa Community. See the AUTHORS.md file at the
+# top-level directory of this distribution and at
+# <https://github.com/sympa-community/sympa.git>.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -539,49 +542,38 @@ sub get_session_cookie {
 ## Set user $email cookie, ckecksum use $secret, expire=(now|session|#sec)
 ## domain=(localhost|<a domain>)
 sub set_cookie {
-    my ($self, $http_domain, $expires, $use_ssl) = @_;
-    $log->syslog('debug', '(%s, %s, secure= %s)',
-        $http_domain, $expires, $use_ssl);
+    $log->syslog('debug', '(%s, %s, %s, %s)', @_);
+    my $self    = shift;
+    my $dom     = shift;
+    my $expires = shift;
+    my $use_ssl = shift;
+
+    $expires = $Conf::Conf{'cookie_expire'} unless defined $expires;
 
     my $expiration;
-    if ($expires =~ /now/i) {
+    if ($expires eq '0' or $expires eq 'session') {
+        $expiration = '';
+    } elsif ($expires =~ /now/i) {    #FIXME: Perhaps never used.
         ## 10 years ago
         $expiration = '-10y';
     } else {
         $expiration = '+' . $expires . 'm';
     }
 
-    if ($http_domain eq 'localhost') {
-        $http_domain = "";
-    }
-
     my $value = encrypt_session_id($self->{'id_session'});
 
-    my $cookie;
-    if ($expires =~ /session/i) {
-        $cookie = CGI::Cookie->new(
-            -name     => 'sympa_session',
-            -value    => $value,
-            -domain   => $http_domain,
-            -path     => '/',
-            -secure   => $use_ssl,
-            -httponly => 1
-        );
-    } else {
-        $cookie = CGI::Cookie->new(
-            -name     => 'sympa_session',
-            -value    => $value,
-            -expires  => $expiration,
-            -domain   => $http_domain,
-            -path     => '/',
-            -secure   => $use_ssl,
-            -httponly => 1
-        );
-    }
+    my $cookie = CGI::Cookie->new(
+        -name     => 'sympa_session',
+        -domain   => (($dom eq 'localhost') ? '' : $dom),
+        -path     => '/',
+        -secure   => $use_ssl,
+        -httponly => 1,
+        -value    => $value,
+        ($expiration ? (-expires => $expiration) : ()),
+    );
 
-    ## Send cookie to the client
+    # Send cookie to the client.
     printf "Set-Cookie: %s\n", $cookie->as_string;
-    return 1;
 }
 
 # Build an HTTP cookie value to be sent to a SOAP client
@@ -681,62 +673,43 @@ sub decrypt_session_id {
 
 ## returns Message Authentication Check code
 # Old name: cookielib::get_mac(), Sympa::CookieLib::get_mac().
-sub _get_mac {
-    my $email  = shift;
-    my $secret = shift;
-    $log->syslog('debug3', '(%s, %s)', $email, $secret);
-
-    unless ($secret) {
-        $log->syslog('err',
-            'Failure missing server secret for cookie MD5 digest');
-        return undef;
-    }
-    unless ($email) {
-        $log->syslog('err',
-            'Failure missing email address or cookie MD5 digest');
-        return undef;
-    }
-
-    my $md5 = Digest::MD5->new;
-
-    $md5->reset;
-    $md5->add($email . $secret);
-
-    return substr(unpack("H*", $md5->digest), -8);
-
-}
+# DEPRECATED: No longer used.
+#sub _get_mac;
 
 # Old name:
 # cookielib::set_cookie_extern(), Sympa::CookieLib::set_cookie_extern().
 sub set_cookie_extern {
-    my ($secret, $http_domain, %alt_emails) = @_;
-    my $cookie;
-    my $value;
-
-    my @mails;
-    foreach my $mail (keys %alt_emails) {
-        my $string = $mail . ':' . $alt_emails{$mail};
-        push(@mails, $string);
-    }
-    my $emails = join(',', @mails);
-
-    $value = sprintf '%s&%s', $emails, _get_mac($emails, $secret);
-
-    if ($http_domain eq 'localhost') {
-        $http_domain = "";
+    $log->syslog('debug', '(%s, %s, %s)', @_);
+    my $self    = shift;
+    my $dom     = shift;
+    my $use_ssl = shift;
+
+    my $value = $self->{'alt_emails'} || '';
+    # Most of browsers allow body of Set-Cookie field at shortest 4093 o,
+    # and value of cookie may not be longer than length below.
+    if (3800 < length $value) {
+        $log->syslog(
+            'info',
+            'Cookie value "%s...%s" is too long (%d). Ignored',
+            substr($value, 0, 25),
+            substr($value, -25),
+            length $value
+        );
+        undef $value;
     }
 
-    $cookie = CGI::Cookie->new(
-        -name    => 'sympa_altemails',
-        -value   => $value,
-        -expires => '+1y',
-        -domain  => $http_domain,
-        -path    => '/'
+    my $cookie = CGI::Cookie->new(
+        -name     => 'sympa_altemails',
+        -domain   => (($dom eq 'localhost') ? '' : $dom),
+        -path     => '/',
+        -secure   => $use_ssl,
+        -httponly => 0,
+        -value    => ($value || 'delete'),
+        ($value ? () : (-expires => '-1d')),
     );
-    ## Send cookie to the client
+
+    # Send cookie to the client.
     printf "Set-Cookie: %s\n", $cookie->as_string;
-    #$log->syslog('notice','%s',$cookie->as_string);
-    return 1;
 }
 
 ###############################
@@ -767,28 +740,8 @@ sub _generic_get_cookie {
 
 # Old name:
 # cookielib::check_cookie_extern(), Sympa::CookieLib::check_cookie_extern().
-sub check_cookie_extern {
-    my ($http_cookie, $secret, $user_email) = @_;
-
-    my $extern_value = _generic_get_cookie($http_cookie, 'sympa_altemails');
-
-    if ($extern_value and $extern_value =~ /^(\S+)&(\w+)$/) {
-        return undef unless (_get_mac($1, $secret) eq $2);
-
-        my %alt_emails;
-        foreach my $element (split(/,/, $1)) {
-            my @array = split(/:/, $element);
-            $alt_emails{$array[0]} = $array[1];
-        }
-
-        my $e = lc($user_email);
-        unless ($alt_emails{$e}) {
-            return undef;
-        }
-        return (\%alt_emails);
-    }
-    return undef;
-}
+# DEPRECATED: No longer used.
+#sub check_cookie_extern;
 
 # input user agent string and IP. return 1 if suspected to be a crawler.
 # initial version based on rawlers_dtection.conf file only
@@ -1017,7 +970,7 @@ Stores session into session store.
 =item check_cookie_extern ( )
 
 I<Function>.
-TBD.
+Deprecated.
 
 =item decrypt_session_id ( )
 
@@ -1037,6 +990,16 @@ TBD.
 =item purge_old_sessions ( )
 
 I<Function>.
+Deprecated.
+
+=item set_cookie ( $cookie_domain, $expires, [ $use_ssl ] )
+
+I<Instance method>.
+TBD.
+
+=item set_cookie_extern ( $cookie_domain, [ $use_ssl ] )
+
+I<Instance method>.
 TBD.
 
 =back
diff --git a/www/js/sympa.js b/www/js/sympa.js
index 22f917c88..eb2d1791d 100644
--- a/www/js/sympa.js
+++ b/www/js/sympa.js
@@ -23,15 +23,20 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-// To confirm on a link (A HREF)
-function refresh_mom_and_die() {
-  url = window.opener.location.href;
-  if (url.indexOf('logout') > -1 ) {
-    url = sympa.home_url;
-  }
-  window.opener.location = url;
-  self.close();
-}
+/* Close login page opened as child window. */
+$(function() {
+    $('body.backToMom').each(function(){
+        setTimeout(function(){
+            if (window.opener) {
+                var url = window.opener.location.href;
+                if (url.indexOf('logout') > -1 )
+                    url = sympa.home_url;
+                window.opener.location = url;
+            }
+            window.close();
+        }, 1000);
+    });
+});
 
 /* Open in a new window. */
 $(function() {