I've recently ran into a bit of trouble with maintaining the aspnet session state across a subdomains of the same application.
The main problem was that the ASPNET SessionID cookie by default points to the full web address, meaning that when you
navigate to a subdomain, aspnet creates a new SessionID cookie for that subdomain and doesnt read the root domains session cookie.
In short, you loose your session variables/authentication info when you browse to subdomains of your site.