Steps to reproduce:

1. docker run -p 8080:8080 -p 50000:50000 jenkins/jenkins:2.275

1. Skip the wizard
2. Create a static agent and connect it
3. Create a freestyle job 'fs' running on the agent and add this shell step:

mkdir -p foo/bar
touch f1 foo/f2 foo/bar/f3

1. Start a build
2. Navigate to http://localhost:8080/job/fs/ws/ and click 'all files in zip'

Fairly reliably, reloading the page will then show the login form.

This only happens for agent workspaces, not archived artifacts or master workspaces.
It also seems to start in 2.275 (with both the SECURITY-1452 fix and Acegi Security), isn't in 2.263.2.