Little rusty on this, but I remember it would pass in two session ids. One was the vSphere session, another a web session or similar. Are you sure that you're getting the right session value?
I also remember a bug where short fqdn name (computer vs computer.local.domain) would cause authentication to fail as well. Since this is determined by what the user logs into the vSphere client with, I would convert the server domain name to ip address in all cases to avoid that issue. It would work fine if the user logged into the vSphere client with either IP address or long-form fqdn.
I may still have some of my web plugin code floating around, I'll see if I can dig it up later this afternoon.