mrkgnao: I don't really have a vendor. I maintain my own virtual server, which hasn't changed in months either.
I meant vendors like third party stuff. (PHP version, NPM packages etc.)
mrkgnao: I too assumed it had something to do with HTTP/HTTPS. Now that you mention that they maintain separate cookies, I'm pretty sure that's it. I'll try to debug it tonight.
Good luck!
mrkgnao: BTW, why do HTTP and HTTPS have separate cookies?
I don't know why - but that is how it works in general. :P localStorage is also not shared between http and https (on browser side).
Although I'm not 50% competent on that topic I guess it's because of security reasons. Someone could take your session cookie with man-in-the-middle attack getting you to http site and he would read the cookie. Evil thing to do.