You are correct, there should be one row in the table for each cookie issued.

I see one thing that may be causing problems. You are trapping errors from the attempted tie to Apache::Session::DBI, but only handling the error if it's from the user not having a saved session. It could be an error from the database, and it's being ignored. Put in an else on that $@ check to re-throw the exception with a die if it doesn't match the regex.

You know, this session code from the Mason site has a lot of problems. Are you sure there isn't something newer included in the distribution?