Hi Joe,
I don't have an answer at this point, but here's some leading questions...
Is this consistent or intermittent?
Are you using X-SAP-PVL in your headers?
Do you notice if any characters in the token have been URL encoded?
What patch level are you at?
If you clear the webi cache, does the issue go away?
Dan