reverse proxy on apache2 and ubuntu

Hmm - interesting deployment give this a shot. This will proxy all requests to the xyz server if the client sends a _session_id cookie.

RewriteEngine On
RewriteCond %{HTTP_COOKIE} _session_id=.+ [NC]
RewriteRule ^/(.*)$ http://xyz.com/$1 [P,L]
ProxyPassReverse / http://xyz.com/

Put it below your existing ProxyPassReverse configuration; the order is significant for the ProxyPass directives.

This seems pretty fragile - I'm sure you have a reason for doing it like this, but is there no other way to separate the authenticated and unauthenticated sections of this application?

Edit: To have the xyz content served from /tracking instead:

ProxyPass /users/sign_in http://xyz.com/users/sign_in
ProxyPassReverse /users/sign_in http://xyz.com/users/sign_in
ProxyPass /tracking/ http://xyz.com/
ProxyPassReverse /tracking/ http://xyz.com/