zombie session information?

That's what I was doing in this step "I've added all sorts of logging and can clearly see that the session var is cleared and right after the next redirect, the variable is set again to what it used to be." in my original post.

It looks like it was a combination of cookie errors.

after making sure that the cookie prefixes were set for the local server and using a unique prefix per test environment and having the sessions be destroyed on regeneration and clearing all the old cookies out of my browser, everything seems to be working now