Likely the user is going to your site as (and logging in to)
http://yoursite.tldOnce they login, they're redirected to your "full url" you set in your CP; which forces them to have to login again, as the "full url" (
http://www.yoursite.tld) is seen as a different domain than
http://yoursite.tld and thus the cookie is invalid...