Not really enough information to truly have an answer, but..
I assume your browser is not the issue, because it works in your development environment in your browser.
Opps just thought of it, clean your cookies, and caches, restart your browser, might as well do the whole computer, I am unsure how some browsers cache information in memory.
If I may suggest, checking the isNew method on session just to ensure that it is new. 99% sure what it will tell you but here is the info:
A servlet should be able to handle cases in which the client does not choose to join a session, such as when cookies are intentionally turned off. Until the client joins the session, isNew returns true. If the client chooses not to join the session, getSession will return a different session on each request, and isNew will always return true.
Lets still assume that the information is being lost between your server and your browser. Sometimes different network paths may lead down other network infrastructure. Most of which should be HTTP 1.1 enabled, but there are a few rogues out there.
Some development tools have an HTTP Monitor built into them, like Netbeans. if not a great free opensource http://www.ethereal.com/
lots of information, but easy to get lost. A better suggestion is to grab one of your network guys, if you have one, and have them trace the information to see where the jsessionid from Tomcat is being dropped.
If it works in development (Same server/same configuration) most likely it is environment/network issue.
best of luck.
Sun Certified Web Business Component Developer
Sun Certified Web Components Developer
Sun Certified Programmer for the Java 2 Platform