[plothook]

found the problem
edit template USERCP and find where you added (when you added this product):

<input type="hidden" name="s" value="$session[sessionhash]" />

and after it, add

<input type="hidden" name="securitytoken" value="$bbuserinfo[securitytoken]" />

-----------------------------------------------------------------------
EDIT: The above is all you need to fix the issue, but what I ended up doing was take all the code out of USERCP and made a new template called qas_usercp

and then added a plugin for this product at usercp_complete with the following code

eval('$template_hook["usercp_main_pos6"] = "' . fetch_template('qas_usercp') . '";');

and changed the code in the cache_templates plugin for this product to:

$globaltemplates[] = 'qas_switchbit';
if (THIS_SCRIPT == 'usercp') {
	$globaltemplates[] = 'qas_usercp';
	$globaltemplates[] = 'qas_userbit';
}

And then I reverted template USERCP - reverted templates are good. Once less template to review at the next upgrade!