Login fails on first try, successful on second...

[drewactual]

the &amp is what's breaking the link.  after session is established cookie set, there is no session in the link. 

so... i'll stfu now. 

[Arantor]

You mean the & that is also in every link for XHTML compliance (which is, incidentally, why SMF tries to use ; by default so it doesn't have to encode & into entity form)?

Again, check a stock installation for its behaviour.