I talk about .NET & IIS.
When type protected resource URL - it starts all OAUTH proccess (getting auth code, and even getting access tokens).
It seems to me - CHROME caches prefetch results, even redirect results. So, when real request begins execute - it got expired auth-code and falls with error.
I try to catch such prefetch requests and cancel it at server side, but it leads to side effects - real requests cancel too.