[eluser]Tom Vogt[/eluser]
WanWizard might be on to something. I see the same behaviour here - very hard to reproduce, but it happens quite often.
I added a bit of debug output to my access control library and it appears, but I've not had enough cases to be 100% certain, that the user data is not set at all when the session fails. It's not set wrong, it's unset.