Getting a lot of these in my error logs:
Type php
Date Wednesday, July 29, 2015 - 08:10
User Guest (not verified)
Location https://example.com/us/flag/flag/wishlist/15843?destination=taxonomy/term/1023&token=d847602157c9ee4af6c1eabfcd1b2d91
Referrer
Message Notice: Undefined index: token in flag_page() (line 25 of ./includes/flag.pages.inc).
Severity notice
Hostname 167.114.156.198
Check key exists before using it, my guess is that it's double encoding the & in cache some place which is a different problem or a bot is doing that, either way it works fine as is, just needs a check.
3.0
Flag core
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I don't think the patch from #13 is the right approach. There can always be malformed requests by bad crawlers, so the page callback needs to be written in a robust way to not throw PHP warnings.
Patch from #1 is the correct approach IMO.
Setting this back to RTBC for patch #1, which is a straight forward fix.