A redirect can cause problems if you are first creating a session and sending the Cookie to the browser. Some browsers are known to ignore cookies that are sent along with a redirect header. Your best bet is to make sure the session gets created on a page that doesn't require a redirect. For example make sure when you display the login page that the session is created at that stage. Then when the user submits the login form, the session already exists, and you can add in your login tokens into the session and then redirect without any worries.

As for the second problem, you should not have to do any of that. Your best bet is to remove the CGI_SESSION_OPTIONS completely and let the Session plugin use its defaults. It should work properly without any configuration.

Hope that helps...

Cheers,

Cees