OK, so my guess is that you're dealing with cache issues either related to the server or Joomla (through some 3rd party extension). If I use the /login.html path, I get all sorts of warnings (e.g. wrong token, sign in again etc.), despite Joomla having me logged in already, cause if I browser to one of the user actions (through the menu), I can see my profile edit page. Now if I use /index.php?option=com_users&task=login I can login and browse the site just fine.

This means something is switching off cache-control for URLs with com_users but not with /login.html.

So check your Page Cache system plugin for starters and if it's enabled, add the right exclusions under the Advanced tab. If you use another caching plugin, search for similar exclusions as well.

All I can say is that this is not a K2 issue really.

1. That extensions does not modify Joomla's caching, it merely deletes it. It's useful to have.
2. Install v2.10.2 on top of v2.10.3. However I insist the issue is elsewhere. When you disable "all K2 extensions" as you say, you may also have disabled a 3rd party extension for K2.

After a 2nd look, it's most likely the system plugin in K2 caused a different issue with how plugins can inject stuff in the document body. You can install K2 v2.10.4 (dev) on top of 2.10.2 to test as well: getk2.org/downloads/?f=K2_Development_Release.zip

My guess is it will resolve your issue. If it doesn't, you can switch back to 2.10.2 again.

It may say "dev", but all code commits are double-checked. Anyway...