Thanks but I chose to go for Eduard's first answer.

Is changing the projection the only way to include them in a single query?

I am aware that I can use the PKs to open each object but wouldn't it impact the performance if the result set has a lot of rows?

I am aware that I can use the PKs to open each object but wouldn't it impact the performance if the result set has a lot of rows?

Difficult to say. Let's assume around 50.

Many to many. One child can have 1 to * parents (no maximum). And a parent can have 0 to * children (no maximum). I cannot say what the average can be.
Also, I've edited my question accordingly, since having a reference to the parent from the child would mean 1 to many. The parent has a list of children now.

No concrete permissions if you mean permitted classes in the web app configuration.

It always gives 401.

I don't redirect to a login page since it is part of a custom application.

It is sent on its own.

That did the trick, but I had the default namespace set until this point and it used to work just fine. Do you have an idea why it suddenly stopped working?