Aha! Found it! I'm using jQuery tabs and wanted to test out the persistent tabs feature. That uses cookies. The expiration on the tabs cookie somehow is wiping the web2py cookie with it. Doesn't seem right to me ... why aren't they segregated? Anyway, that's what's going on.
Try setting up a tabs interface with jQuery.ui and then initialize the tab with: jQuery("#mytabs").tabs({ cookie: { expires:1} }) You will see that the login immediately expires with the tabs cookie.