On 02/05/2014 02:52 PM, Deichgraf wrote:
  Ok, I just checked the xwiki.cfg
  
[...]
 If I read this correctly the keys aren't at their default, because they
 aren't commented out?
 I haven't touched the .cfg up to now.
  
The default is "unset" (I think).
Anyway, you are expected to uncomment them and replace the dummy text by some random
non-dummy text.
Something I forgot: To test the "request coming in from different IP's"
hypothesis You also need to set:
xwiki.authentication.useip=false
(which is not present in the xwiki.cfg)
See:  
http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Security#HCookies
Clemens