Normally we see this when the user tries to log into the Enterprise Manager and the URL isn't a trusted web site. If that's not it pay attention to the address bar when you click login button and see if the site info in the URL changes.
Thanks Jeff! I guess that should have been the first thing to look at. Thanks again!