In the phpBB 3.2.6 and phpBB 3.2.7 releases, much attention was paid to the fact that login forms defined by the proSilver style needed to have {S_FORM_TOKEN_LOGIN} added to their templates, and that phpBB itself needed to have called add_form_key() on all the pages where those proSilver login forms existed (which phpBB 3.2.6 initially had not covered all of them).

With phpBB 3.2.7 all of the proSilver-defined login forms are handled (except perhaps https://tracker.phpbb.com/browse/PHPBB3-16046).  And the phpBB 3.2.7-specific workaround (https://tracker.phpbb.com/browse/PHPBB3-16042) allows even styles which haven't been updated to work, for the pages on which proSilver also has a login form.

What has perhaps been overlooked despite all this focus is the fact that prior to phpBB 3.2.6, any template could provide a login form if it wanted to, and {S_LOGIN_REDIRECT} was made available for every page.  Now, despite the fact that {S_LOGIN_REDIRECT} is still being made available to every page, it is no longer possible for a template to offer a login form "except on the pages where proSilver offers a login form."  (Or on the pages an extension has created, and the extension has been updated to call add_form_key().)

This seems like the needed remedy for phpBB 3.2.8 or whatever is to start calling add_form_token() and generating {S_FORM_TOKEN_LOGIN} for every page, same as {S_LOGIN_REDIRECT} has always been available.  Not withstanding the PHPBB3-16042 workaround which will then combine these values into S_LOGIN_REDIRECT for compatibility with existing styles, albeit temporarily until some future release.

Without such a change, user styles such as Metro are now failing to login on phpBB 3.2.6 and later, and no amount of following the style template editing advice can solve it (for the pages where Metro offers login on a template where proSilver does not offer login).