As a followup on this, we're working on this in a ticket. It appears to be a problem with PHP not clearing the session files.