Force a session to become HTTPS?
Long story short: It wasn't Drupal. We have the Brocade Traffic management stuff running above the site (and on local sites too so the dev environment is as close to live as possible).

The HTTP/HTTPS switching in that was causing the problem. After working with it for so long I should have checked it. Such is the life of a professional developer.