I am not sure about using tokens to solve this problem...it might work. My first thought is that
you should have one action that does the initial login processing. That action should have a forward that passes control onto another action (say DisplayWelcome.do) with redirect set to true. When the user refreshes the page it will just call the DisplayWelcome action.
- Brent