Obvious question, but one I occasionally overlook: are you letting the site set a cookie? If so, are you limiting it to a session cookie? (I'm not sure if they require permanent cookies, but more and more sites do these days.)