Bah. Found the cookie-handling problem, and it's arising because of how the servlet containers handle browsers without cookies.

If your jsp calls request.getCookies() and there were no cookies with the request, jserv returns you a zero-length array of Cookies. Tomcat returns null. This is really dumb - everything now has to check whether the return value is null before proceeding, when what you probably want to do is loop through them anyway. If you get an empty array back, your loop code will just fall straight through and everybody's happy. Unfortunately, tomcat's the one following the API spec so we can't really complain!

http://java.sun.com/products/servlet/2.3/javadoc/index.html

T
- posted by Tim Bruce @ 11:28 AM