That's very helpful Phillip.  I bet we're running into a similar situation.  I've also got the compound problem of the site existing as both http:// and https://  

Hi there! I known thats an old thread bu ti got the same error in elgg 1.5

Users must intro 2 times login info. 1st one always throw a token error and second time always works.

Has anyone found a solution to this?

Thanks in advanec for your answers.

Almost certainly you installed the site to www.foo.com but are visiting foo.com.

The token will be generated for www.foo.com on the foo.com login, so login will fail the first time and then forward back to www.foo.com.

Simple solution is to configure your server to forward foo.com to www.foo.com.