Let's escalate this to a bug, instead of a forum discussion, so we have better tracking and can incorporate it into release managed. Hari, could you file it, with a verbose repro case? Lars, could you verify that your new code is indeed in 5.0.4?
if { $expiration_time < 30 } {
# If expiration_time is less than 30 seconds, it's practically impossible to login
# and you will have completely hosed login on your entire site
set expiration_time 30
}
This bug has been there since the beginning of times.