The extension is setting the user's prev_url value to the data script according to my few tests. This won't occur if you log in on a page the shoutbox isn't running on, and outputting that variable in the login script points to your data.php with the token parameters.