Hi Dane, Torben and everyone,
I've done a lot of investigation on this problem, and yes, basically any call the ad_con will eventually fail in a host node mapped subsite.
The fix is tricky befure the call to ad_conn -set is done AFTER the filters are proccessed. So, even if we fix the filters (rp_filter) and fix the redirect, ad_conn -set won't see this change.
To fix it would be a big problem, because we would have to change the exact place in request-processor where the ad_conn -set is called. Ni first looking it would be a major rewriting of request processor code.
Mayvbe somebody with better knowledge on RP can propose a better solution.