C.R.,
I'm running 3.2.5, but I experienced something similar to the last problem you mention, that requests to images were creating redirects to login.
I ended up creating a more elaborate system for breaking out of secured pages and fine tuning what gets passed through SSL. To get consistent behavior I created a couple procs to check lists of directories and file extensions to either ignore or include while going into or breaking out of secured pages. Since then things have run very well, although I haven't done load testing and I'm not sure how much overhead my approach is adding.
Let me know if the code is of interest and I can post it or email it.
