Closed
Description
When CP session type is set to session only, session identificator is appended to URL like this: &S=a5644d41749e3c4e69befff96a662376
When idle popup is shown and password is entered, this code gets executed:
$.getJSON(EE.BASE + '/login/refresh_csrf_token', function(result) {
which results in invalid URL, so token is never updated, causing logout on form submission