Problem resolved. The script was missing a session->flush() line. I'm guessing that (although I've seen other scripts work fine without it) the problem was related to the redirect that was in the script.