Form token wrong if logging in during rebuild
The only way I could fix it was to set $form['#token'] to FALSE when building the form. This disables the token checking functionality, which isn't ideal, but I think it's my only option.