I see your point, Torben. But not all POSTs are made to the same directory. See my permissions example above.
The problem, as Eduardo pointed out, lies with when to set ad_conn url, and the hack for mapped subsites that is already in place in rp_filter.
# 2. handle special case: if the root is a prefix of the URL,
# remove this prefix from the URL, and redirect.