One possibility that comes to mind is that the user that is running the webserver (ie, in Apache, usually 'nobody' or 'www') must have write permissions for the dir where so-called "session cookies" are stored (usually /tmp in UNIX, maybe c:\windows\temp?)