CRAFT_CSRF_TOKEN is failing to write
Ok - think I figured this out.  Our dev site is hosted on a sub-domain of our production site, which is served over HTTPS.  Seems like the CRAFT_CSRF_TOKEN
cookie set by our production site is the same that's trying to be set by our dev site, and since dev is served over HTTP, it's unable to overwrite the one set by the production server.  Clearing out cookies on production fixed the problem. I imagine setting up HTTPS on dev would also do the trick, but clearing the prod cookie is a quicker fix at the moment.