it seems that when the session times out using the jAlert/javascript, the camefrom parameter automatically gets reset to index.php.
the camefrom parameter is one of the nicer "new" features (at least to me); and it would be nice if it was kept when the javascript alert takes over the screen after a session timeout.
if this behavior is not expected i will do my own troubleshooting to determine where i went adrift...