in reply to Security: Dancer Session cookie swap
First make sure your sessions are persisting between reboot of the server. I'd recommend using MySQL. If your sessions are file based (and say, in /tmp), they could potentially get flushed out.
So the only way that the same sessions will be getting doled out is if your session data on the server is not persisting and if the session IDs don't have the proper entropy - i.e., if the sessions are sequential integers and reset each reboot, then you'd have the same kind of problems that you're seeing.