I ran into a bug like this with rails and restful_authentication. It came from caching the logged in user through the session. I fixed it by using a cookie to store the logged in user instead. Here's the issue: http://stackoverflow.com/questions/145169/inadvertent-sessio...