switched from fsso collector agent to fortiauthenticator, now users randomly blocked.

We were using the fsso collector agent on server but recently switched to using the fortiauthenticator.  However, after that switch, most of our users (including myself) get blocked randomly from websites that they should be able to access.  When it happened to me today I popped onto the authenticator and my username was still showing up in the fsso user list.

Any suggestions where to look?  We use the windows event logon polling FYI.