The page is no longer valid, that's really what's going on ;)
There's mainly three scenarios when this happens:
* User clicks link twice in an email (for example reset password)
* User clicks link in email after it has expired
* User spends to long on the login form(s)
Problem is that we don't know exactly which of the above is the problem as the session details may be lost. So I believe "This page is no longer valid" is generic and still gives the user an idea of what's happened. Refreshing the page is not going to help as the page is no longer valid (login details are either lost due to timeout, or login has already happened), so to resolve the problem the user has to "try login again from the application". We can replace "the application" with the name of the client if we now it and also make it clickable if the client has a baseurl set.