The authentication was pulling the user from the cookie, which was not getting reset.  Removed the check on the cookie and rely only on the session var