OK, latest behavior after you changed modules: I entered the site yesterday at jomsocial and had been logged out, so I cleared my cache and logged back into jomsocial yesterday. After selecting forum I found I was not logged in with Kunena, so I had to log in again. I stayed in the forum and did not log out or close Firefox. I was logged out when I went back to jomsocial this morning. I killed 6 new spammers after seeing one active on the forum. Again, I stayed in the forum and did not log out or close Firefox. I went back to jomsocial this afternoon, and I was logged out and had to log in again. I entered the forum, and I was logged out of there, so I had to log in again, and when I did, I got the dreaded invalid token. When I hit the back button it wanted me to log in again. I ignored that and selected Site News, and I was actually logged in. That's where I am now.

The new login module did not support recaptcha without errors, so I turned it off. The underlying issue is caused by not logging out of the site manually. If you let it time out (60 minutes) then your browser thinks you are logged in, but you are actually not.

I have also read that Search-Friendly (SEF) URLs can sometimes cause the issue. So:

1. SEF is off
2. reCaptcha is back
3. The old login module is back.

Let's see how this goes...

I will log out manually next time. I whacked 11 new spammers this afternoon. Will watch future levels.

I plugged a recaptcha hole that would allow bots to sign in through Jomsocial vice the register in the Login menu. Let me know if you see more spammers.

For all, this invalid token thing has been driving me crazy. Every time I think it is conquered something else comes up. Well....I think I have another possible solution in play. The error happens when someone has the site open in their browser and the session ends. This is the same issue if the site is loaded from your browser cache. You will appear logged in but you are really not. Joomla then thinks you are trying hack the site and blocks you with an "invalid token" error. I *think* I have a fix. I turned off system caching, which should help. I tested it by logging into the site and then, from the admin back end, forced a logout. When I refreshed the page or went to any other site link, it immediately showed that I was logged out.

The best thing to do is just log out when you are done with the site, but feel free to stress test the site and let me know what issues you have...thanks!

Seems to be working fine for me on both my iPad and iPhone without logging out.

Great news! Please let me know if anything comes up.