What do you mean by 'user-data'? I looked at 'login-data'

That one, yes. It contains cookies.

(...) the bot is still able to login under some
circumstances.

Then find out /which/ circumstances these are. I can imagine nothing bad happens as long as the secondary server does not send mediawiki cookies (xxwiki_userid etc), so that these are not overwritten.

Also 'python login.py -test' claims to be logged in...

I am not sure what this tests, but I can imagine this only tests if the cookie file exists.

But what would be the best to do in your optinion? Wipe out all those
files and re-login once and then store a copy of the files to compare?

Compare the specific one, of course. Log in to xxwiki, copy wikipedia-xx-username.data, do your getUrl stuff and compare the files.

Or do what I just did: read the getUrl function and conclude there is indeed cookie-updating stuff there.

it does re-loading attempts AND it applies correct unicode
encoding to the html page contents. Both is not done by urlopen as far
as I know...(?)

Right. Then abstract that stuff out of the Site urlopen into a seperate module, and use that.

Best,

Merlijn