My webapp was using default sessionState settings with mode set to 'InProc' and it was configured to use default application pool. The problem was caused by the application pool using Web Garden with 5 worker processes. When using InProc mode the worker processes DO NOT share session data!
2 possible solutions:
- Configure application pool to use 1 worker process: in IIS Manager right click yout application pool > Properties > Performance > Web Garden section
- Use different session state mode e.g. state server or sql server (set in web.config)