Currently, tlclient.cgi uses the old style do_login API. It needs to be updated to use the new one. This means that we must use the thinlinc-login approach, thus doing calls as the target user. This might be tricky: tlclient.cgi is typically not running as root but instead as a user such as "httpd". Thus, it cannot change to the target user. One solution is to actually start an SSH connection, just like tlclient does. Another one is to consider the architecture for the HTML5 client (bug 4132). The current idea for that bug is to introduce a new daemon "websocketserver" that runs as root, corresponding to sshd. Perhaps tlclient.cgi can do logins through this daemon as well. This way, we do not need to start SSH connections for any browser client.
Since the Java client will be removed, we can remove this code from tlclient.cgi entirely. Will be done on bug 4597 and bug 5191.
