Those extra parameters/code after the ".php" in the URL are sent from Square, and are part of the handshake involved in setting the token between your site and Square's servers.
This afternoon I'll try to simulate the "failure" response you're talking about. Maybe they've recently changed something that's causing it? I'll post back when I have some findings.
Bookmarks