I had similar issues. It got a bit confusing as session timeouts etc. seem to come in to play, so things I did seemed to work then it stopped working etc. as I experimented with different combinations.
In the end, things I did that solved it:
I changed the front end session type to cookie, and explicitly added the XID hash to all my login forms (actually ALL forms), e.g.
input type="hidden" name="XID" value="{XID_HASH}"
Also, and this was important I think, I cleared exp_sessions of old sessions data (will log you out obviously). It would have been easier to work out the issues if I had done this after each change.
And in my config, I changed back from secure cookies only, set my cookie domain, and made sure the cookie gets expired on browser close (this is with focuslab llc so adapt if you're not using that).
+$env_config['cookie_secure'] = 'n';
+$env_config['cookie_domain'] = "mydomain.net";
+$env_config['expire_session_on_browser_close'] = 'y';
As far as I can tell, these changes are to do with 2.8.1 and secure forms changes, i.e. secure forms are on by default. But it's all a bit unclear and maybe someone more informed can give a better reason as to the whys of it all - but this got it all working again (both front and back ends)
Hope this gets you going!!