Re: Smell like....
Really?! I guess you are not a web developer then.
There are many many more common things that could cause this. race conditions on non-thread-safe resources would be right down the bottom of my list.
Normally this is something to do with caching somewhere in the auth mechanism. Can be as simple as an auth cookie being cached in a front-end HTTP proxy/cache. Or overly caching pages which should not be cached.