How do I preserve user sessions across subdomains?
Figured this out, the appId setting was the culprit: https://craftcms.com/docs/config-settings#appId

If using this setting, you probably don't want to set it to something dynamic (as I was, e.g. md5($url)).