With the new auth module coming with REL1.27 the apache need the following rules
<VirtualHost *:80>
AllowEncodedSlashes On
</VirtualHost>
to let you click the links on Special:RemoveCredentials, because these links contains encoded backslashes. Just for information, if someone can verify and maybe add it, would be nice.