The "Your session has timed out" message presumably is the site expiring MoodleSession which is a session cookie in the browser. That sounds like normal behaviour.
For the "Invalid login. Please try again." I can only suggest using the browser's developer tools (e.g. Network Monitor in Firefox) to compare the requests, e.g.:
- what fields are in the POST request and what values they have,
- what URL they're being posted to,
- what HTTP status the server responds with.
Doing this for a successful and unsuccessful login will hopefully reveal a discrepancy.