Thanks for your reply, Dan.
Is this consistent or intermittent?
Consistent. Tested on two BO environments with multiple browsers.
Are you using X-SAP-PVL in your headers?
Nope, but it's in the IMG URL. I tried removing it from the call but there was no change.
Do you notice if any characters in the token have been URL encoded?
Yes, they are URL encoded. Just for fun, I tried sending the un-encoded token in the URL, but that did not work.
What patch level are you at?
BI41. SP05 Patch 7
If you clear the webi cache, does the issue go away?
No
Is it all browsers or a specific browser?
Tested in IE, Firefox, Chrome, and direct with Fiddler