I have a ASP.NET MVC workflow configured as two websites managed by a load balancer. The websites use Sql Server as the session state provider and have authentication switch
Sessions have (web) application scope. See if this MS KB helps.
Update:
Interesting down vote. Perhaps my suggestion needs more clarity.
In addition to matching machine keys, you also have to match the IIS configuration for sites (so it's the "same application" (application path) in IIS.