pfSense

Yes, it's the standard CP with SSL login enabled, i.e. CP answers http requests (forwarded via ipfw to 127.0.0.1:8000) and redirects them via the 302 code (see the http in first post) to lighttpd SSL listening at port 8001.

My test setup for this bug is very simple -- see xml snippet:

        <captiveportal>
                <page/>
                <timeout>240</timeout>
                <interface>lan</interface>
                <idletimeout>15</idletimeout>
                <freelogins_count/>
                <freelogins_resettimeout/>
                <auth_method>local</auth_method>
                <reauthenticateacct/>
                <httpsname>hotspot.domain.tld</httpsname>
                <preauthurl/>
                <bwdefaultdn/>
                <bwdefaultup/>
                <certificate>aaaaaaaaaa</certificate>
                <cacertificate>bbbbbbbbbb</cacertificate>
                <private-key>ccccccccc</private-key>
                <noconcurrentlogins/>
                <redirurl/>
                <radiusip/>
                <radiusip2/>
                <radiusport/>
                <radiusport2/>
                <radiusacctport/>
                <radiuskey/>
                <radiuskey2/>
                <radiusvendor>default</radiusvendor>
                <radiussrcip_attribute>wan</radiussrcip_attribute>
                <radmac_format>default</radmac_format>
                <httpslogin/>
                <enable/>
        </captiveportal>

OK, just synced my 2.1 with the file from git, and the malformed 302 redirection URL issue seems fixed.

However:
1) previously generated vouchers don't seem to work (as defined in the copied over 2.0.1 xml) producing "invalid credentials specified"
2) voucher generation seems to have issues. Btw when I click "save" on the CP's Vouchers tab without having changed anything on that page, any created Voucher Rolls vanish!
I'll investigate further and probably open a new ticket, if necessary.