Ruth says: "When we switched to more modern site pages, we started using the HTTP Referer header to redirect users back to the page they were originally on when they made the login/logout request. Recent updates in both Chrome and Firefox have started placing restrictions on reading the Referer header, for security reasons, with the result that users weren't getting sent back to the page they had come from properly. After some back-and-forth, we decided the nicest solution was to explicitly set the return location (which, incidentally, is more or less what the older BML pages did)."

Oh, cool. I'd noticed that problem myself but assumed it was my security settings being too paranoid again. Thank you, Ruth!