[eluser]slowgary[/eluser]
I don't believe that to be the exact case. An AJAX call DOES update the client's cookie. The problem is this:
If your session ID is old enough to need regeneration and you issue 2 requests at the same time, the first request hits the server and causes the session class to regenerate the id. The problem is that the second request has already left the client with an invalid session ID before the first request is able to bring the new session ID back to the browser. The second request then becomes the culprit - causing your session to be destroyed.
In essence, it's a race condition. You can't really solve the problem by removing the call to sess_update() on AJAX calls, since the same scenario can happen without AJAX. For instance, if you protect your assets by serving them through a controller, your pages will be making many concurrent requests to the session class and you'll likely see this problem often.
