Just had a client on the phone who was experiencing issues when they log into their site.
On further inspection, they are using IE11. When I test, it seems to be putting the auth (or some kind of cookie) token into the URL. This kind of works but the site URL's are all including this token. As soon as they hit a direct URL (i.e. as they should be formed) it gives an error.
From what I can tell, IIS/ASP.NET isn't recognising IE11 as a cookie-enabled browser! Very bad bug if this is the case.
As soon as I put IE11 into IE10 mode (and user-agent) in developer tools everything is OK again.
Could it be there is an outstanding update to be done on the server? I'm hoping for a global fix here rather than a site-by-site fix.