Guess #1: the J2EE app is trying to set a session cookie on the client, and the perl script is throwing it away.

Guess #2: the J2EE app knows that it session cookies are disabled on the client side, and is setting its session value using url encoding, and the perl script is somehow stripping it out.