When uploading multiple images with ezmultipload, only the first image is uploaded, and the user gets logged out.
The frontend seems to process all images, but only the first thumbnail is shown. Navigating to another page afterwards redirects to the login screen.
Starting with the second AJAX request, the response has an additional Set-Cookie header:
and returns the HTML User Login Page.
The first request overwrites the session cookie with a new value - I don't know why, but that seems to be the reason why the second request is not recognized as being logged in.
Found it: When eZ Find adds an object to the index, the session gets regenerated with a new session ID. I will create a pull request and reference it in a comment.