Thanks for the answer,
I tried using a client in bash (modified from [1] to exit after getting the edit token), and it seems to work : I do get an edit token after logging in.
I then modified the bash example to have more information on what is sent/received (--trace, ...), and I noticed than curl is sending back the cookies in a single header (instead of one header for each cookie as Apache HttpClient is doing by default).
So, I changed my own code to force grouping cookies in a single header (by setting http.protocol.single-cookie-header to TRUE), and it seems to work now.
Thanks a lot !
Nico