As you use session-based cookies, have you looked at what cookie values the browsers get?

Personally, I would not use Memcached while debugging a session/storage problem. Start with Plack::Session::Store::File and without a cache to eliminate Memcached as a problem source and to make it easy for others to replicate your problem.

Aaah - now I realize. You said "all other users get $session->{counter} incremented by 2". So, is it that the first user sees:

1
<reload>
2
<reload>
3
[download]

... and the other users see

1
<reload>
3
<reload>
5
[download]

?

Then I would look at what requests the browsers send to your server and print out each request, and the session value before and after. Maybe the session value is also incremented for static stuff like CSS or image files? Or for the 404 page that a missing favicon.ico creates?