@mattdjuk This could be something (clutching at straws a bit here)...
I was just looking in the cookies, I see these:
Screenshot 2022-05-26 113221.png
It has 2 express.sid cookies
1 is for forum.$$$$$$$.co.uk and the other is for .$$$$$$$.co.uk
It looks like you forgot to set the callback url or one of the access keys, and it is just guessing the url to go to.