This message was deleted.

Watch netscaler syslog for "SSLVPN LOGIN" and "ICASTART" messages while logging in/launching sessions - you should be able to validate which (if any) tags are being sent to SF via the list of session policy matches

Check the "Require Token Consistency" box in Storefront for each store (I can't remember which SF menu its on). As far as I remember it disables Smart Access filters