There are many differences in default behavior with IE7 that might be causing what you're seeing.
In IE7, by default, you have to explicitly allow Javascript to run on every site. That includes subdomains of the same site (a.site.com, b.site.com). Losing a session generally means losing cookies, so if cookies are ever created or read with Javascript, that might be what you're seeing.
It has nothing to do with Tomcat or JSP, by the way, so you don't need to ask questions in those forums. You might try adding the Web Development forum, since it gets a lot more experts looking at it than Internet Explorer Web Browser.