2
I have had the same problem before. The only solution I found was to not have the redirect masked. The same thing happens when you try to use an XOOPS site in an iframe across domains. It is a built in security feature. I think I read about a way to turn it off, but it sounded risky.
Magick can never be restrained, but when freely given is thrice regained!