At a guess, this is laziness and buffering interacting:  stderr is usually unbuffered since it's error or log output that one usually wants to see immediately; stdout is usually line buffered unless redirected, in which case it's block buffered.

The real issue is that you (or perhaps Curl) is being too lazy and not running the log_in until the result is actually needed; hPutStrLn is forcing it, but incompletely when it's buffered.  (Which strikes me as weird unless Curl is using unsafeInterleaveIO somewhere....)  You will need to force it or hold the handle open until the content is fully evaluated; if it's in the half-closed state that hGetContents sets, it's usually best to not close the handle explicitly but let the implicit lazy close do it.