I would suspect this has to do with your authentication and/or authorization (lists):
crypto ssl profile SSL_PROFILE
match policy SSL_POLICY
aaa authentication user-pass list FLEX
aaa authorization user user-pass list FLEX_SSL SSL_AUTH_POL
aaa authorization group user-pass list default hannes2
authentication remote user-pass
virtual-template 10
If you use debug aaa authentication
and debug aaa authorization
does it tell you anything?
Rene