So this has always been a problem with Rails SessionStore. The problem is that if your app is sending concurrent requests and one of them is updating a session then depending on which request wins in the race you might get the stale session variables instead on the updated one. The problem is better explained at other places like http://dev.rubyonrails.org/ticket/8256 and the solution is a plugin smart_session_store by Frederick Cheung.
It might not seem a very informative post to you, but I am still posting it as this has taken me quite a bit of time to find out. And after finding it, I am astonished to see why Rails still can not deal with this issue.
Note: I am talking about Rails 2.3.8 here. Not sure if Rails 3 has a fix for it or not.