The issue was for the form based authentication. In the form it used a jstl tag for the action like this:
<form action="<c:url value='/j_security_check'/>" method="post"> ...
Now, that looks correct. In websphere when you type in a username and password (good or bad), it doesn't set the ltap cookie, but then it tries to forward you on to the page you requested, which then generates a 403 not authorized. The above tag targets the root of your app (since it has the leading slash).
The issue seem to be that you have to have the action target to the same location of your jsp that's used for the login page. If you target the context root but your jsp is in some path like [context root]/secure-section/login.jsp, it won't work.
In the end it sometimes pays not to be fancy. Just leave your login action as a plain html one like this:
<form action="j_security_check" method="post"> ...