Hey Paul.
Can your client log in with an alternate browser? That would eliminate the cookie issue.
If you could update to 1.6, that would make it easier to trouble shoot, since we’d be looking at the same code. If/when you do update the regular expression will be restored, but if you choose not to update, could you go into core.input.php and change the regular expression back to its default, and around line 410 change to
exit('Disallowed Key Characters');into
exit('Disallowed Key Characters: '.$str);In fact, change that line no matter what - it’ll tell us what is triggering the error.
Finally, if the character set is getting borked, that could explain it. Could you go into CP Home › Admin › System Preferences › General Configuration and tell me what your default character set is?
Thanks