Same problem. After upgrade from 3.5.2 to 3.5.2+ users can't login. Logs shows only php notice "Invalid Login Token: username"
Situation is solved via setting $CFG->disablelogintoken = true; but I'm not sure is this the right way.....
[Sat Nov 10 18:48:31.023407 2018] [php7:notice] [pid 13118] [client 192.168.50.254:47490] [client 78.63.93.52] https://gabijos.vma.lm.lt Invalid Login Token: jtamulevicius Mozilla/5.0 (Win
dows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36, referer: https://gabijos.vma.lm.lt/login/index.php
[Sat Nov 10 18:48:41.607562 2018] [php7:notice] [pid 13118] [client 192.168.50.254:47516] [client 78.63.93.52] https://gabijos.vma.lm.lt Invalid Login Token: jtamulevicius Mozilla/5.0 (Win
dows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36, referer: https://gabijos.vma.lm.lt/login/index.php
[Sat Nov 10 18:48:55.334276 2018] [php7:notice] [pid 3764] [client 192.168.50.254:47576] [client 78.63.93.52] https://gabijos.vma.lm.lt Invalid Login Token: jtamulevicius Mozilla/5.0 (Wind
ows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36, referer: https://gabijos.vma.lm.lt/login/index.php
[Sat Nov 10 18:49:21.427521 2018] [php7:notice] [pid 13429] [client 192.168.50.254:47642] [client 78.63.93.52] https://gabijos.vma.lm.lt Invalid Login Token: jtamulevicius Mozilla/5.0 (Win
dows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36, referer: https://gabijos.vma.lm.lt/login/index.php
[Sat Nov 10 18:49:23.112903 2018] [php7:notice] [pid 8505] [client 192.168.50.254:47652] [client 78.63.93.52] https://gabijos.vma.lm.lt Invalid Login Token: jtamulevicius Mozilla/5.0 (Wind