Some users are still having problems with the pop-up login. I think they are actually getting 403s because of the CSRF protection. So I have modified the base template to always have a javascript variable called csrf_token available when they aren't logged in. The ajax_login.js script was then modified to send this value with the ajax post. Fingers crossed.

<script type="text/javascript">
//<![CDATA[
$(document).ready(function() {
   var jumpSelect = $('#forum-jumpbox-select')[0];
   $('#forum-jumpbox-button').click(function() {
      var dest = jumpSelect.options[jumpSelect.selectedIndex].value;
      window.location = dest;
   });
});
//]]>
</script>