no apparent reason. The fix is to enable cherrypy's implicit session file locking, which, interestingly enough, isn't enabled implicitly.