Yes, that's what the problem was! Working now.
On another, purely cosmetic note, I have an htaccess rule set up so that I can dispense with the .php file extensions. When logging in though, I find that the .php extension is added back automatically to the page the user is redirected to. Is there any way to change this? So for example, user clicks link to protected page:
www.mysite.co.uk/members --> redirected to www.mysite.co.uk/login --> is then redirected to www.mysite.co.uk/members.php. I want them to be taken to www.mysite.co.uk/members instead.
Not a big deal, but Google Analytics does then view these as separate pages i.e. members and members.php