[SalesForce] Communities Welcome Email – Set Password link not working ({!Community_URL})

Background:

We've enabled communities and set up user profiles, access etc. There are no login flows nor SSO going on, everything is pretty standard apart from a custom login page (active site homepage). Email templates for welcome new user, forgot password and change password on the community are all set up and we use the default templates that have the merge field {!Community_URL}. In all 3 templates the value for this merge field gets replaced by a SF specific URL which looks like:

your_community_domain/communitiy_name/login?c=TOKEN

When an email is sent to the communities enabled user for forgot password or reset password, the link that salesforce sends in the {!Community_URL} works just fine, the user is taken to a set password (ChangePassword) page so that they can enter their new password without having to type the old password (since it's been reset).

Problem:

The problem is when the welcome email gets sent out, the link in the email looks fine, however, when the user clicks on that link, the system logs them in the portal and redirects them back to /apex/TheCustomLoginPage (CustomLoginPage == Site Active Homepage).

Then by typing /home/home.jsp in the URL, I can see that the user is logged in. If I navigate to the change password page, it asks me for the old password, which I have never entered in the first place.

UPDATE:

I've changed the communities landing and login page back to the
original ones, now the welcome email link takes me straight in to the
community /home/home.jsp. Again, I'm logged in and not redirected to setup the
initial password.

Workarounds:

I have identified 2 workarounds for the time being:

• Disable the welcome email and use the reset password email as a welcome email too.

• Build a custom change password page and forward the users to that page if the "referrer" on the landing page contains "frontdoor.jsp"

Question(s):

1) Is this a problem due to having a custom landing page/controller?

2) Is there a better workaround?

3) Where/Why is the /apex/ appended to the redirect URL when this is related to Communities and not internal VF?