ASP.NET sees the session cookie and loads the session (or doesn't, and starts a new one). This is why people recommend serving static, unauthenticated resources like images from a separate domain.

In my code I put Session.Timeout=480 so that a session won't expire for 8 hours. But sessions still timed out pretty frequently, so I decided to put an hidden aspx page in an IFRAME in the header ...