And this ticket:
http://trac.roundcube.net/ticket/1488087

I'll go comment there too, but I am embarrassed to admit it was actually just that I had changed des_key and session_domain which caused the problems! I've kept them the same as they were in version 0.5.1 and rolled out 0.6. Thanks again for an AMAZING webmail!

Perhaps relatedly, we do want to change our 'des_key' but am unsure if 
that is safe to do. Also 'session_domain' which we seem to have in 
production as '' (NULL)

Eventually I suppose it would be an improvement to set session_domain, and we would also like to change des_key. . . Any ideas how to do that without causing the session issues?