Wow again. It did not even dawn on me that it was possible for the client to not have created an SSP, but that was the case. No SSP = no session state. I'm creating the SSP now and will associate the web app with it, then I expect it to work, but we'll see...