Authentication should be on the checkout page and would have the return url of the pp_confirm page. Maybe the problem is the action for the express checkout page should submit to itself and not to the pp_confirm page directly. 
Thanks RAY that was the problem. I had removed <?php echo $_SERVER['PHP_SELF']; ?> when the item started failing and posted to the pp_confirm page, which didn't help. Restoring it to the self reference allowed me to complete the transaction. It must have been another error that caused the glitch...


