Asp.Net Webforms security - breaks app moving to .Net 4 - webforms

Question

I've moved an application from WebForms in .Net 3.5 to .Net 4. The only change was to the web.config to remove the 3.5 extensions, since they are part of .Net 4 now.
I have the following applet tag (Persists software JUpload control) in a site securied using FormsAuthentication and a custom principal:
<APPLET
id="UploadCtl"
CODE="persits.transfer.gui.UploadUI.class"
ARCHIVE="JUpload.jar"
WIDTH="99%" HEIGHT="200"
NAME="JUpload" MAYSCRIPT="yes"
>
<PARAM NAME="cabbase" VALUE="JUpload.cab" />
<PARAM NAME="UseSockets" VALUE="false" />
<param name="DNDOverrideEnabled" value="true" />
<PARAM NAME="ShowTransferButton" VALUE="false" />
<PARAM NAME="AllowAddFiles" VALUE="true" />
<param name="AllowRemoveFiles" value="true" />
<param name="UploadURL" value="/site/manageDocumentsPost.aspx" />
<param name="FinalURL" value="/site/manageDocuments.aspx" />
<PARAM NAME="DebugInformation" VALUE="true">
<param name="MaxFileSize" value="2500" />
<PARAM NAME="Cookie1" VALUE="ASP.NET_SessionId=<% =SessionId %>">
<PARAM NAME="Cookie2" VALUE="<%=FormsCookieName %>=<%=FormsCookieValue %>">
</APPLET>
Basically the control will post to the url specified in UploadURL. The two cookie parameters are there to ensure that the user's SessionId and FormsAuthTicket are sent by the upload applet when doing the post.
As I stated, this works perfectly in .Net 3.5 (CLR 2.0). Moving to .Net 4, CLR4, what seems to happen is that the request for /site/ManageDocumentsPost.aspx gets redirected to the logon page, and the control then displays this assuming the upload went fine. The post page never actually executes it's code though (and the post should return nothing, thus causing the control to ask for the FinalUrl).
Using Fiddler I can see that the manageDocumentsPost causes a redirect, and this redirect has a different Asp.Net SessionId.
Any ideas what might have changed to cause this? More importantly, any ideas to get it functioning again?
Thanks
Andy

Answer 1

Ok, I figured out how to get this working.
previously I was storing the principal in session, and loading in the AquireSessionState event.
Now I store the principal in the cache during logon and write some information into the ticket to allow me to locate it in the cache.
In the AuthenticateRequest event, if the user is authenticated I can easily find the actual principal and get it from the cache. For some reason though the control causes this event to fire unauthenticated, but the session and formsauthcookie are both present in the request. I decrypt the auth cookie, and then use the information in the ticket to find the principal again.
In this way the user is authenticated by the end of the event handler, and everything can proceed normally.
Hope that helps someone else.