After doing a bit of searching on the net I found the cause and the solution.

The cause:
My Pulpcore applet trying to do a request a CakePHP action from the web server to get and set the highscores.
CakePHP would check the HTTP_USER_AGENT and compare it to the one used to create the session.
When it found that they differed it would kill the session thinking it was preventing a session hijack attempt.

A solution:
In the config/core.php set the following lines
Configure::write(’Session.checkAgent’, false);
Configure::write(’Security.level’, ‘medium’);

This will stop CakePHP from regenerating a session every request and stop CakePHP from checking the user agent.
After that my Pulpcore applets where able to request actions as the logged in user fine and keep the session alive.