When CP session type is set to session only, session identificator is appended to URL like this: &S=a5644d41749e3c4e69befff96a662376
When idle popup is shown and password is entered, this code gets executed:
$.getJSON(EE.BASE + '/login/refresh_csrf_token', function(result) {
which results in invalid URL, so token is never updated, causing logout on form submission
When CP session type is set to session only, session identificator is appended to URL like this:
&S=a5644d41749e3c4e69befff96a662376When idle popup is shown and password is entered, this code gets executed:
which results in invalid URL, so token is never updated, causing logout on form submission