Virtual Server sending resets to the client and the node.

Since the code-upgrade was on the app, and you get the resets after logging-in, I suspect that a certain http request may not be compliant.

Also take a look at the profile, there are some limits.. for e.g. of headers, max header value, etc.

If you are terminating SSL, you can use tcpdump and the key file to decrypt the traffic (you may have to downgrade the cipher temporarily). Then inspect the http request just before the resets and check if that has any offending content/issues.

Also other app related issues, such as cookies, etc. might be in play too. For e.g. if the app uses Java and the cookie set by the App is not set correctly to allow access to JVM only the browser, but these debug steps can be taken after ruling out the basic http level issues.

cheers.