I think I have confirm this, because as I change the code in
lib/python/ZPublisher/HTTPResponse.py function _cookie_list
so that several cookie is sent back via
"Set-Cookie: key1=val1; key2=val2"
Instead of two "Set-Cookie:" Header, than I can login into CMF.
Yuan-Chen Cheng