What Oliver has said is the unfortunate truth.
Little nagging SERVER issues of MANY kinds can creep in from time to time.
My WILD guess, at your problem, would be that the PHP session data MAY STILL BE WRITING when the script redirects user to backend in "login.php" (meaning that the session may be lost upon redirect). If I remember right... the function definition for header('Location: ...') on php.net mentions something like this.
One way around it might be to TRY a function
session_write_close(); before
header('Location: ...') gets initiated (as a "trouble-shooting" determination) to ensure preservation of session data, BEFORE the redirect is attempted.
Why not try placing one in "login.php":
mysql_free_result($check);
$_SESSION['PHPWCMS_ROOT'] = PHPWCMS_ROOT;
session_write_close();
header("Location: ".PHPWCMS_URL."phpwcms.php");
exit();
OR replace header('Location: ...') with one of these (substitute the correct URL representation for my "shorthand"):
header("Refresh: 0; URL=\"$url\"");
<meta http-equiv="refresh" content="0;url=<?=$url?>" />
<script type="text/javascript">
window.location.href='<?=$url?>';
</script>
In some environments, it MAY need initiation of a header('Location: ...') -=BEFORE=- setting $_SESSION variables, and then the NEXT header('Location: ...') will PRESERVE the session variables on redirect. Slight variations of procedure may need experimentation! NO FUN
Some other trouble-shooting techniques might involve trying other methods of geting from login.php to phpwcms.php. That might be something like removing the redirect, staying on the current page and writing in a "clickable" link that would take you there.
Also make sure of little things like making sure you have a "fully-qualified" path in "conf.inc.php":
// site values
$phpwcms["site"] = "http://www.mydomain.de/";
Some OTHER typical issues with session:
-Insufficient free space in the server's session file for the user.
-Various settings in httpd.conf, php.ini, .htaccess files can affect sessions differently when PHP is enabled as ISAPI module, instead of CGI.
-PHP enabled as CGI treats some header directives differently.
-Servers using load balancing may write session data in /tmp dir of A, but when a new page is requested it is being served from B.
-ISP/Webhost issues with server caching proxy/webcache "schemes".
-Browser settings/plugins/addons (also unrecognized user_agent string) and/or local "security" applications (virus/firewall).
Good luck!! If you find out anything, it would be great to get your feedback. 
