Recover include intended behavior:this include was supposedly looking at subgroups of the provided group_id (clearly stated in the doc), while in fact scope was always forcefully set on package_id from the connection
call sec_login_handler instead of just sec_generate_session_id_cookie, since otherwise, cryptographically valid session cookie could be used without a ad_login_cookie