Here's what I see in the browser
---------Logging in-------------

Request Headers
Host 173.203.105.235
User-Agent Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Accept */*
Accept-Language en-us,en;q=0.5
Accept-Encoding gzip, deflate
Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection keep-alive
Content-Type application/json; charset=UTF-8
X-Requested-With XMLHttpRequest
Referer http://173.208.105.235/api.html
Content-Length 87

-----------------------------

Response Headers
Server nginx/1.0.4
Date Thu, 21 Jul 2011 14:55:06 GMT
Transfer-Encoding chunked
Connection keep-alive
X-Powered-By Express
Set-Cookie wdialef51s00s=4edaae8b004e0c6d740968fd6b7f9c89c23b5a2a0d373de44a937605899127bc; path=/; expires=Thu, 21 Jul 2011 15:10:06 GMT; httpOnly connect.sid=L96yGUBwoDwrQLqm2xlhBsZB.XHduhuaqAHqocaN6%2F0gCKQG6uiZtPb1UsSdGRTFpxgM; path=/; expires=Thu, 21 Jul 2011 15:05:11 GMT; httpOnly
--------------------------------

Login successful. As you can see, connect.id cookie is set (this is what Express.js session uses). Now, I make a request to resource where session is checked:

--------------------------------
Request Headers
Host 173.203.105.235
User-Agent Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Accept */*
Accept-Language en-us,en;q=0.5
Accept-Encoding gzip, deflate
Accept-Charset ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection keep-alive
X-Requested-With XMLHttpRequest
Referer http://173.208.105.235/api.html
Cookie wdialef51s00s=4edaae8b004e0c6d740968fd6b7f9c89c23b5a2a0d373de44a937605899127bc; connect.sid=L96yGUBwoDwrQLqm2xlhBsZB.XHduhuaqAHqocaN6%2F0gCKQG6uiZtPb1UsSdGRTFpxgM

-------------------------------

Response Headers
Server nginx/1.0.4
Date Thu, 21 Jul 2011 14:56:09 GMT
Transfer-Encoding chunked
Connection keep-alive
X-Powered-By Express
Set-Cookie connect.sid=L96yGUBwoDwrQLqm2xlhBsZB.XHduhuaqAHqocaN6%2F0gCKQG6uiZtPb1UsSdGRTFpxgM; path=/; expires=Thu, 21 Jul 2011 15:05:11 GMT; httpOnly

-------------------------------

Now, I just stumbled upon something I didn't notice yesterday: the property that I save on request session - the one that I can't get to work - apparently DOES work sometimes. Basically, if I keep logging in and requesting resource - it works on some attempts. However, if I keep requesting the resource after successful attempt - it breaks after few requests and session goes back to original state.

This is just bizarre.